Skip to content
OpenAdvisories
High WID-SEC-2024-1592 6 CVEs

GitLab: Mehrere Schwachstellen

Published Jul 10, 2024 · Updated Jul 10, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um seine Privilegien zu erweitern, einen Denial-of-Service-Zustand zu erzeugen, Dateien zu manipulieren, vertrauliche Informationen offenzulegen oder beliebigen Code auszuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 6

  • Critical 9.6
    CVE-2024-6385

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circum…

    GitLab GitLab Web / CMS
  • Medium 4.9
    CVE-2024-5257

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Developer user with `admin_compliance_framework` custom role may have been able to modify the URL for a group namespace.

    GitLab GitLab gitlab gitlab-agent Web / CMS Ubuntu
  • Low 3.8
    CVE-2024-5470

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.

    GitLab GitLab gitlab gitlab-agent Web / CMS Ubuntu
  • Low 3.5
    CVE-2024-5528

    Incomplete Comparison with Missing Factors in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.0
    CVE-2024-6595

    Uncontrolled Search Path Element in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 2.7
    CVE-2024-2880

    Improper Access Control in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group mem…

    GitLab GitLab gitlab gitlab-agent Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References