9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.8%
Gitlab reports:
Run pipelines as any user
Stored XSS injected in imported project’s commit notes
CSRF on GraphQL API IntrospectionQuery
Remove search results from public projects with unauthorized repos
Cross window forgery in user application OAuth flow
Project maintainers can bypass group’s merge request approval policy
ReDoS via custom built markdown page
Private job artifacts can be accessed by any user
Security fixes for banzai pipeline
ReDoS in dependency linker
Denial of service using a crafted OpenAPI file
Merge request title disclosure
Access issues and epics without having an SSO session
Non project member can promote key results to objectives
9.6 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
6 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
46.8%