Skip to content
OpenAdvisories
High WID-SEC-2024-1216 8 CVEs

GitLab: Mehrere Schwachstellen

Published May 21, 2024 · Updated Apr 22, 2025 · Revision 4 · de-DE

Vendor: Atlassian Product: Bitbucket Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site-Scripting-Angriff (XSS) durchzuführen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 8

  • High 8.0
    CVE-2024-4835

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-2874

    Allocation of Resources Without Limits or Throttling in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted description has the potential to disrupt the loading of targeted GitLab web resources.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.6
    CVE-2024-4367 Public exploit EPSS 71%

    PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF

    A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ESR < 115.11, and Thunderbird < 115.11.

    Mozilla Firefox Thunderbird Firefox ESR Browsers Debian Ubuntu npm
  • Medium 5.4
    CVE-2023-7045

    Cross-Site Request Forgery (CSRF) in GitLab

    A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-5258

    Authorization Bypass Through User-Controlled Key in GitLab

    An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2023-6502

    Inefficient Regular Expression Complexity in GitLab

    A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible for an attacker to cause a denial of service using a crafted wiki page.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-1947

    Improper Handling of Highly Compressed Data (Data Amplification) in GitLab

    A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted AP…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.0
    CVE-2024-5318

    Missing Authorization in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job arti…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #4

    PoC für CVE-2024-4367 aufgenommen

  2. #3

    Neue Updates von Atlassian aufgenommen

  3. #2

    CVE Nummern ergänzt

  4. #1

    Initiale Fassung

References