Skip to content
OpenAdvisories
Medium WID-SEC-2024-1899 3 CVEs

GitLab: Mehrere Schwachstellen

Published Aug 21, 2024 · Updated Aug 21, 2024 · de-DE

Platform: Linux

Summary

Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um beliebige Kommandos auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu erzeugen oder Sicherheitsmaßnahmen zu umgehen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 3

  • Medium 6.4
    CVE-2024-7110

    Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.7
    CVE-2024-6502

    Incorrect Provision of Specified Functionality in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-3127

    Improper Access Control in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restr…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References