Skip to content
OpenAdvisories
High WID-SEC-2024-3453 7 CVEs

GitLab: Mehrere Schwachstellen

Published Nov 12, 2024 · Updated Feb 6, 2025 · Revision 3 · de-DE

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um seine Privilegien zu erhöhen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand zu erzeugen oder einen Cross-Site-Scripting-Angriff durchzuführen.

Product

GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.

Vulnerabilities 7

  • High 8.5
    CVE-2024-9693

    Incorrect Authorization in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster un…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.8
    CVE-2024-7404

    Improper Restriction of Rendered UI Layers or Frames in GitLab

    An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the De…

    GitLab GitLab Web / CMS
  • Medium 6.5
    CVE-2025-1072

    Allocation of Resources Without Limits or Throttling in GitLab

    A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14.1 prior to 17.3.7, 17.4 prior to 17.4.4, and 17.5 prior to 17.5.2. A denial of service could occur upon importing maliciously crafted content using t…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 6.1
    CVE-2024-8648

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially cr…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Medium 5.4
    CVE-2024-8180

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.

    GitLab GitLab Web / CMS
  • Medium 5.3
    CVE-2024-10240

    Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab

    An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some informati…

    GitLab GitLab gitlab Web / CMS Ubuntu
  • Low 3.1
    CVE-2024-9633

    Incorrect Ownership Assignment in GitLab

    An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name mat…

    GitLab GitLab gitlab Web / CMS Ubuntu

Revision history

  1. #3

    CVE ergänzt

  2. #2

    CVE ergänzt

  3. #1

    Initiale Fassung

References