GitLab Information Disclosure Vulnerability

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery, and other features. An information disclosure vulnerability exists in GitLab EE, which stems from ...

PT-2024-4735 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.0 through 16.11.4 GitLab EE versions 17.0 through 17.0.2 GitLab EE versions 17.1 through 17.1.0 Description: The issue allows an attacker to access issues and epics without having an SSO session using Duo Chat. This is...

GitLab 13.2 < 13.4.7 / 13.5 < 13.5.5 / 13.6 < 13.6.2 (CVE-2020-26412)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2. CVE-2020-26412 Note that Nessus has not...

BIT-GITLAB-2020-26412

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2...

BIT-GITLAB-2021-22183

An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions...

BIT-GITLAB-2021-39883

Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows subgroup members to see epics from all parent subgroups...

BIT-GITLAB-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

GitLab 13.11 < 14.1.7 / 14.2 < 14.2.5 / 14.3 < 14.3.1 (CVE-2021-39883)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper authorization checks in all versions of GitLab EE starting from 13.11 before 14.1.7, all versions starting from 14.2 before 14.2.5, and all versions starting from 14.3 before 14.3.1 allows...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. This could be exploited with user interactions due to a stored XSS in the epics page...

Authorization Bypass

gitlab is vulnerable to Authorization Bypasses. It is possible for an unauthorized authenticated user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

UBUNTU-CVE-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417: Incorrect Authorization

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group...

CVE-2023-1417

CVE-2023-1417 affects GitLab versions 15.9 before 15.9.4 and 15.10 before 15.10.1. The issue allows an unauthorised user to add child epics linked to a victim’s epic in an unrelated group, implying a cross-group authorization flaw. The connected sources document the affected ranges and the nature...

PT-2023-16970 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.9 through 15.9.3 GitLab versions 15.10 through 15.10.0 Description: An issue has been discovered in GitLab where it was possible for an unauthorized user to add child epics linked to a victim's epic in an unrelated group...

GitLab 15.9 < 15.9.4 / 15.10 < 15.10.1 (CVE-2023-1417)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child...

PT-2023-9824 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 17.6.0 Description: The issue is related to insufficient protection of service data when adding non-image attachments, resulting in a lack of authentication procedure. This allows a remote attacker to bypass...