Skip to content
OpenAdvisories
High WID-SEC-2024-3136 8 CVEs

GitLab: Mehrere Schwachstellen

Published Oct 9, 2024 · Updated Oct 9, 2024 · de-DE

Platform: Windows

Summary

Ein entfernter, authentisierter oder anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um erhöhte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand zu erzeugen, einen Cross-Site-Scripting-Angriff durchzuführen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 8

  • Critical 9.6
    CVE-2024-9164

    Missing Authentication for Critical Function in GitLab

    An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.2
    CVE-2024-8970

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circums…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.2
    CVE-2024-8977

    Server-Side Request Forgery (SSRF) in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attac…

    GitLab GitLab Web / CMS
  • High 7.5
    CVE-2024-9631

    Inefficient Algorithmic Complexity in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 7.3
    CVE-2024-6530

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render a…

    GitLab GitLab Web / CMS
  • Medium 4.9
    CVE-2024-9623

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 4.3
    CVE-2024-5005

    Incorrect Provision of Specified Functionality in GitLab

    An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.7
    CVE-2024-9596

    Inclusion of Sensitive Information in Source Code in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. It was possible for an unauthenticated attacker to determine the GitLab version number for a GitLab …

    GitLab GitLab Web / CMS

Revision history

  1. #1

    Initiale Fassung

References