Skip to content
OpenAdvisories
Medium WID-SEC-2023-3153 8 CVEs

GitLab: Mehrere Schwachstellen

Published Dec 13, 2023 · Updated Dec 13, 2023 · de-DE

Platform: Linux

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um seine Privilegien zu erweitern, einen Denial of Service zu verursachen, falsche Informationen darzustellen und Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 8

  • High 7.4
    CVE-2023-6680

    Improper Certificate Validation in GitLab

    An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if the…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-6564

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab EE Premium and Ultimate affecting versions 16.4.3, 16.5.3, and 16.6.1. In projects using subgroups to define who can push and/or merge to protected branches, there may have been instances in which subgroup members with t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.7
    CVE-2023-6051

    Improper Control of Generation of Code ('Code Injection') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when source code or installation packages are pu…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.9
    CVE-2023-3907

    Improper User Management in GitLab

    A privilege escalation vulnerability in GitLab EE affecting all versions from 16.0 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows a project Maintainer to use a Project Access Token to escalate their role to Owner

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.8
    CVE-2023-5512

    Improper Control of Generation of Code ('Code Injection') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used fo…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-3904

    Improper Validation of Specified Type of Input in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible to overflow the time spent on an issue that altered the deta…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-5061

    Missing Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to ove…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.0
    CVE-2023-3511

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 8.17 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. It was possible for auditor users to fork and submit merge request…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References