Skip to content
OpenAdvisories
Medium WID-SEC-2024-1367 5 CVEs

GitLab: Mehrere Schwachstellen ermöglichen Denial of Service und Cross-Site Scripting

Published Jun 12, 2024 · Updated Jun 12, 2024 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Denial of Service Angriff durchzuführen und einen Cross-Site-Scripting-Angriff zu starten.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 5

  • Medium 6.5
    CVE-2024-1495

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.1 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. It was possible for an attacker to cause a denial of service using malicious…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-1736

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's CI/CD pipeline editor could allow for denial of service attacks thr…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.5
    CVE-2024-1963

    Uncontrolled Resource Consumption in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.4 prior to 16.10.7, starting from 16.11 prior to 16.11.4, and starting from 17.0 prior to 17.0.2. A vulnerability in GitLab's Asana integration allowed an attacker to potentia…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.4
    CVE-2024-4201

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in ra…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2024-5469

    Uncontrolled Resource Consumption in GitLab

    DoS in KAS in GitLab CE/EE affecting all versions from 16.10.0 prior to 16.10.6 and 16.11.0 prior to 16.11.3 allows an attacker to crash KAS via crafted gRPC requests.

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References