Skip to content
OpenAdvisories
Critical WID-SEC-2024-0216 7 CVEs

GitLab: Mehrere Schwachstellen

Published Jan 25, 2024 · Updated Mar 18, 2025 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebigen Programmcode auszuführen, unbekannte Auswirkungen zu verursachen, Dateien zu manipulieren, einen Denial of Service Zustand herbeizuführen oder Sicherheitsvorkehrungen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • Critical 9.9
    CVE-2024-0402 Public exploit

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a worksp…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.1
    CVE-2023-41056

    Redis vulnerable to integer overflow in certain payloads

    Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and …

    Redis Redis redis redis Debian Alpine
  • Medium 6.5
    CVE-2023-6159

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 12.7 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 It was possible for an attacker to trigger a Regular Expression Denial of Service via a `Cargo.toml` containing malic…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.4
    CVE-2023-5933

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2023-5612 Public exploit

    Missing Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. It was possible to read the user email address via tags feed although the visibility in the user profile has been disabled.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-0456

    Direct Request ('Forced Browsing') in GitLab

    An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Unscored —
    CVE-2023-45322

    libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in…

    libxml2 libxml2 libxml2 Debian Azure Linux Wolfi

Revision history

  1. #2

    Exploit aufgenommen

  2. #1

    Initiale Fassung

References