Input validation

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-5963

GitLab EE Advanced Search vulnerability (CVE-2023-5963) affects GitLab EE versions 13.9–16.3.6, 16.4 before 16.4.2, and 16.5 before 16.5.1. The issue allows a denial-of-service in Advanced Search by chaining too many syntax operators. Remediation: upgrade to GitLab version 16.4.2 or 16.5.1 or lat...

CVE-2023-5963 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab EE with Advanced Search affecting all versions from 13.9 to 16.3.6, 16.4 prior to 16.4.2 and 16.5 prior to 16.5.1 that could allow a denial of service in the Advanced Search function by chaining too many syntax operators...

CVE-2023-5963

Removed by vendor...

CVE-2023-3399

The CVE-2023-3399 entry affects GitLab EE: unauthenticated access to CI/CD variables read via custom project templates by unauthorized project/group members. Affected versions are GitLab EE 11.6 up to 16.3.6, 16.4 up to 16.4.2, and 16.5 up to 16.5.1. The provided sources describe the issue and it...

CVE-2023-3909

Removed by vendor...

CVE-2023-3909 Inefficient Regular Expression Complexity in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.3 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A Regular Expression Denial of Service was possible by adding a large string in timeout input in...

CVE-2023-3909

GitLab CE/EE is affected by CVE-2023-3909: A Regular Expression Denial of Service can be triggered by a very large string in timeout input within gitlab-ci.yml. Affected versions are: all 12.3–16.3.5, all 16.4.x before 16.4.2, and all 16.5.x before 16.5.1. Root cause stated is inefficient regex h...

CVE-2023-3246

CVE-2023-3246 affects GitLab EE/CE across multiple branches: all versions before 16.3.6, all versions from 16.4 before 16.4.2, and all versions from 16.5 before 16.5.1, with the impact described as the ability for an attacker to block the Sidekiq job processor. The connected documents reiterate t...

Default configuration

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...

Design/Logic Flaw

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.2 before 16.3.6, all versions starting from 16.4 before 16.4.2, all versions starting from 16.5 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path and cause the server to...

CVE-2023-5825

GitLab CE/EE CVE-2023-5825 affects 16.2–16.3.5, 16.4.0–16.4.1, and 16.5.0 before 16.5.1. A low-privileged attacker can point a CI/CD Component to an incorrect path, causing memory exhaustion via an infinite loop and Denial of Service. Impact: availability only. Remediation: upgrade to GitLab 16.3...

CVE-2023-5831

GitLab CE/EE vulnerable when the super_sidebar_logged_out feature flag is enabled. Affected versions are: 16.0–16.3.5, 16.4.x prior to 16.4.2, and 16.5.x prior to 16.5.1. In these cases, with the flag enabled, there is a risk of unintentionally disclosing GitLab version metadata to unauthorized a...

CVE-2023-5831 Insertion of Sensitive Information Into Sent Data in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.0 before 16.3.6, all versions starting from 16.4 before 16.4.2, and all versions starting from 16.5.0 before 16.5.1 which have the supersidebarloggedout feature flag enabled. Affected versions with this...

CVE-2023-5831

Removed by vendor...

PT-2023-26778 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.3 through 16.3.6 GitLab CE/EE versions 16.4 through 16.4.2 GitLab CE/EE versions 16.5 through 16.5.1 Description: A Regular Expression Denial of Service issue was discovered, allowing an attack by adding a large strin...

1182.ee Cross Site Scripting vulnerability OBB-3762427

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-3932

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan...

CVE-2023-3900

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. An invalid 'startsha' value on merge requests page may lead to Denial of Service as Changes tab would not load...