GitLab 13.12 < 16.2.7 / 16.3 < 16.3.4 (CVE-2023-5009)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.2.7, all versions starting from 16.3 before 16.3.4. It was possible for an attacker to run pipeline jobs ...

PT-2023-29945 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 10.6 through 16.1.5 GitLab versions 16.2 through 16.2.5 GitLab versions 16.3 through 16.3.1 Description: An issue has been discovered in GitLab where any user can read limited information about any project's imports...

CVE-2023-4378

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. A malicious Maintainer can, under specific circumstances, leak the sentry token by changing the...

UBUNTU-CVE-2023-3210

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content...

Cross-site Scripting (XSS)

gitlab is vulnerable to Cross-site Scripting XSS. The vulnerability exists due to the lack of user input sanitization in the library, which allows an attacker to inject and execute malicious javascript through the maliciously crafted merge request...

Improper Authorization

gitlab is vulnerable to Improper Authorization. An attacker could exploit this vulnerability to gain control of a GitLab project by importing members from another project that they control. This could allow the attacker to steal data, modify code, or delete the project...

Information Disclosure

gitlab is vulnerable to Information Disclosure. An attacker can read environment names supposed to be restricted to project memebers only...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to the explosure of authorization header which allows an attacker to gain access to read authorization headers...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists because the non-project members can see the default branch name for projects...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists in the SendEntry of the library, which allows an attacker to gain sensitive information through the URL of artifacts stored in object storage with a temporary availability via Rails logs...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability exists due to improper permissions rules allowing an attacker to read confidential Epic references...

Improper Access Control

gitlab is vulnerable to Improper Access Control. The vulnerability exists because the requirement to enforce 2FA is not honored when using git commands allowing an attacker to perform unauthorized actions...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This vulnerability occurs due to a flaw in the way that GitLab handles invited group members. An attacker can exploit this vulnerability to gain access to a project even if they have not been invited to the project. This can be used to gain access t...

Cross-Site Scripting (XSS)

gitLab is vulnerable to Cross-Site Scripting XSS. This vulnerability occurs due to a flaw in the way that GitLab handles the DataDog integration configuration. An attacker can exploit this vulnerability to inject malicious code into a project's DataDog configuration, which can then be executed by...

Denial Of Service (DoS)

gitlab is vulnerable to Denial Of Service DoS. The vulnerability exists because an attacker can cause uncontrolled resource consumption with a very long issue or merge request description, leading to an application crash...

Information Disclosure

gitlab is vulnerable to Information Disclosure. The vulnerability occurs because marshalled session keys were being stored in redis, resulting in Cleartext Storage of Sensitive Information...

Information Disclosure

gitlab is vulnerable to Information Disclosure. This issue allows a member of a private group to validate the use of a specific name for a private project resulting in generation of error message containing sensitive information...

Arbitrary Code Execution

gitlab is vulnerable to Arbitrary Code Execution. An attacker can inject and execute malicious code on server...

Uncontrolled Resource Consumption

gitlab is vulnerable to Uncontrolled Resource Consumption. This allows a malicious attacker to create a recursive pipeline relation resulting in them being able to exhaust resources...

Uncontrolled Resource Consumption

gitlab is vulnerable to Uncontrolled Resource Consumption. Thie allows a malicious attacker to spike the server resource utilization resulting in a potential denial of service...