Skip to content
OpenAdvisories
Medium WID-SEC-2024-1073 11 CVEs

GitLab: Mehrere Schwachstellen

Published May 7, 2024 · Updated May 7, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Denial of Service Angriff durchzuführen, um Sicherheitsmechanismen zu umgehen und um Informationen offenzulegen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 11

  • High 7.5
    CVE-2024-2878 EPSS 23%

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible for an attacker to cause a denial of service by crafting un…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-6682

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. A problem with the processing logic for Discord Integrations Chat Messages …

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2023-6688

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logic for Google Chat Messages integration may lead to a regular expression DoS attack on the server.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-2454 EPSS 33%

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-2651 EPSS 33%

    Inefficient Regular Expression Complexity in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. It was possible for an attacker to cause a denial of service using maliciously…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-3976

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and de…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.4
    CVE-2024-1211

    Cross-Site Request Forgery (CSRF) in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instanc…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.7
    CVE-2024-4597

    Cross-Site Request Forgery (CSRF) in GitLab

    An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve a…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2024-1539

    Missing Authorization in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using t…

    GitLab GitLab Web / CMS
  • Medium 4.3
    CVE-2024-4539

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 where abusing the API to filter branch and tags could lead to Denial of Serv…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.6
    CVE-2023-6195

    Server-Side Request Forgery (SSRF) in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.5 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. GitLab was vulnerable to Server Side Request Forgery when an attacker uses …

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References