Skip to content
OpenAdvisories
Critical 1 exploited CVE WID-SEC-2024-0077 5 CVEs

GitLab: Mehrere Schwachstellen

Published Jan 11, 2024 · Updated Jan 11, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Benutzerrechte zu erlangen, Daten zu manipulieren und um Sicherheitsmaßnahmen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 5

  • Critical 10.0
    CVE-2023-7028 Exploited Public exploit Scanner template EPSS 94%

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account passwor…

    GitLab GitLab gitlab Web / CMS Ubuntu
    KEV May 1, 2024
  • High 7.6
    CVE-2023-4812

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.3 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2. The required CODEOWNERS approval could be bypassed by adding chang…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.3
    CVE-2023-5356

    Incorrect Authorization in GitLab

    Incorrect authorization checks in GitLab CE/EE from all versions starting from 8.13 before 16.5.6, all versions starting from 16.6 before 16.6.4, all versions starting from 16.7 before 16.7.2, allows a user to abuse slack/mattermost integrations to execute sl…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.6
    CVE-2023-6955

    Missing Authorization in GitLab

    A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.5
    CVE-2023-2030

    Improper Verification of Cryptographic Signature in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References