Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting oder Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen, Daten zu manipulieren oder vertrauliche Daten einzusehen.
Product
GitLab ist eine Webanwendung zur Versionsverwaltung für Softwareprojekte auf Basis von git.
Vulnerabilities 27
-
High 8.2
Regular Expression Denial of Service in websocket-extensions (RubyGem)
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte seque…
-
High 8.1
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The revocation feature was not rev…
-
High 8.0
GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authorization scope change without user consent in…
-
High 7.2
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality…
-
High 7.1
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of pe…
-
Medium 6.9
jQuery has a potential XSS vulnerability
In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…
-
Medium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. API Authorization Using Outdated C…
-
Medium 6.5
A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the …
-
Medium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerab…
-
Medium 6.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the Grap…
-
Medium 6.4
A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration w…
-
Medium 5.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored …
-
Medium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. In certain cases an invalid userna…
-
Medium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind S…
-
Medium 5.4
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy…
-
Medium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Project reporters and above could …
-
Medium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser at…
-
Medium 4.3
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was e…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab wa…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secre…
-
Low 3.8
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current us…
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be ab…
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a…
-
Low 3.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not …
-
Low 3.5
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating projec…
-
Low 2.7
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentica…
Revision history
-
#3
Neue Updates von openSUSE aufgenommen
-
#2
Neue Updates von Ubuntu aufgenommen
-
#1
Initiale Fassung
References
-
GitLab Security Release 13.3.4, 13.2.8, and 13.1.10 vom 2020-09-02
https://about.gitlab.com/releases/2020/09/02/security-release-gitlab-13-3-3-released/
-
Ubuntu Security Notice USN-4502-1 vom 2020-09-16
https://ubuntu.com/security/notices/USN-4502-1
-
Ubuntu Security Notice USN-4502-1 vom 2020-09-16
https://usn.ubuntu.com/4502-1/
-
openSUSE Security Update OPENSUSE-SU-2025:15130-1 vom 2025-05-18
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3ZQXVCWSC6AX6RNK43O7WPCY77YBJ6EX/