Skip to content
OpenAdvisories
High WID-SEC-2024-0460 8 CVEs

GitLab: Mehrere Schwachstellen

Published Feb 21, 2024 · Updated Feb 21, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, Dateien zu manipulieren, seine Privilegien zu erweitern oder einen Cross-Site-Scripting (XSS)-Angriff durchzuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 8

  • High 8.7
    CVE-2024-1451 EPSS 51%

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.7
    CVE-2024-0410

    Improper Enforcement of Behavioral Workflow in GitLab

    An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.7
    CVE-2023-6477

    Incorrect Privilege Assignment in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admin_group_member perm…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-6736

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 11.3 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for an attacker to cause a client-side denial of s…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.3
    CVE-2024-1525

    Authentication Bypass Using an Alternate Path or Channel in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-4895

    Missing Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' set…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-0861

    Direct Request ('Forced Browsing') in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects`…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2023-3509

    Incorrect Authorization in GitLab

    An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. It was possible for group members with sub-maintainer role to change the title of privat…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References