Summary
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Sicherheitsmaßnahmen zu umgehen oder seine Privilegien zu erweitern.
Product
GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.
Vulnerabilities 2
-
High 7.7
Incorrect Authorization in GitLab
An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform …
-
Medium 6.5
Privilege Chaining in GitLab
A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.
Revision history
-
#1
Initiale Fassung
References
-
GitLab Security Release: 16.9.2, 16.8.4, 16.7.7 vom 2024-03-06
https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/
-
Github Advisory
https://github.com/advisories/GHSA-rhx5-h5p6-9g65
-
Github Advisory
https://github.com/advisories/GHSA-27h4-9w4j-cp97