Skip to content
OpenAdvisories
Medium WID-SEC-2024-2219 3 CVEs

GitLab: Mehrere Schwachstellen

Published Sep 25, 2024 · Updated Sep 25, 2024 · de-DE

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen preiszugeben.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 3

  • Medium 5.5
    CVE-2024-4278

    Incorrect Synchronization in GitLab

    An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain De…

    GitLab GitLab Web / CMS
  • Low 3.1
    CVE-2024-4099

    Improper Encoding or Escaping of Output in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to …

    GitLab GitLab Web / CMS
  • Low 2.6
    CVE-2024-8974

    Incorrect Provision of Specified Functionality in GitLab

    Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #1

    Initiale Fassung

References