Debian Gitlab vulnerabilities

CVE-2022-3482 [MEDIUM] CVE-2022-3482: gitlab - An improper access control issue in GitLab CE/EE affecting all versions from 11.... An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an unauthorized user to see release names even when releases we set to be restricted to project members only Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13331 [MEDIUM] CVE-2020-13331: gitlab - An issue has been discovered in GitLab affecting versions prior to 12.10.13. Git... An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS by in the Wiki pasges. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2021-39894 [MEDIUM] CVE-2021-39894: gitlab - In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability... In all versions of GitLab CE/EE since version 8.0, a DNS rebinding vulnerability exists in Fogbugz importer which may be used by attackers to exploit Server Side Request Forgery attacks. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-10079 [MEDIUM] CVE-2020-10079: gitlab - GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain condition... GitLab 7.10 through 12.8.1 has Incorrect Access Control. Under certain conditions where users should have been required to configure two-factor authentication, it was not being required. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2022-3870 [MEDIUM] CVE-2022-3870: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility. Scope: local sid: resolv

CVE-2019-11546 [MEDIUM] CVE-2019-11546: gitlab - An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9... An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has a Race Condition which could allow users to approve a merge request multiple times and potentially reach the approval count required to merge. Scope: local sid: resolved (fixed in 11.8.9+dfsg-1)

CVE-2023-3922 [LOW] CVE-2023-3922: gitlab - An issue has been discovered in GitLab affecting all versions starting from 8.15... An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-3949 [MEDIUM] CVE-2023-3949: gitlab - An issue has been discovered in GitLab affecting all versions starting from 11.3... An issue has been discovered in GitLab affecting all versions starting from 11.3 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for unauthorized users to view a public projects' release descriptions via an atom endpoint when release access on the public was set to only project members. Scop

CVE-2024-2191 [MEDIUM] CVE-2024-2191: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 16.... An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2024-7047 [HIGH] CVE-2024-7047: gitlab - A cross site scripting vulnerability exists in GitLab CE/EE affecting all versio... A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2022-2904 [HIGH] CVE-2022-2904: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v... A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrar

CVE-2022-3486 [MEDIUM] CVE-2022-3486: gitlab - An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 p... An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1431 [MEDIUM] CVE-2022-1431: gitlab - An issue has been discovered in GitLab affecting all versions starting from 12.1... An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious requests to the PyPi API endpoint allowing the attacker to cause uncontrolled resource consumption. Scope: local sid: resolved (fixe

CVE-2020-13294 [MEDIUM] CVE-2020-13294: gitlab - In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when... In GitLab before 13.0.12, 13.1.6 and 13.2.3, access grants were not revoked when a user revoked access to an application. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2022-3793 [MEDIUM] CVE-2022-3793: gitlab - An improper authorization issue in GitLab CE/EE affecting all versions from 14.4... An improper authorization issue in GitLab CE/EE affecting all versions from 14.4 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to read variables set directly in a GitLab CI/CD configuration file they don't have access to. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-3740 [MEDIUM] CVE-2022-3740: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group owner may be able to bypass External Authorization check, if it is enabled, to access git repositories and package registries by using Deploy tokens or Deploy keys . Scope: local sid: resolved (fixed in 15.10.

CVE-2023-6955 [MEDIUM] CVE-2023-6955: gitlab - A missing authorization check vulnerability exists in GitLab Remote Development ... A missing authorization check vulnerability exists in GitLab Remote Development affecting all versions prior to 16.5.6, 16.6 prior to 16.6.4 and 16.7 prior to 16.7.2. This condition allows an attacker to create a workspace in one group that is associated with an agent from another group. Scope: local sid: resolved (fixed in 16.6.5-3)

CVE-2024-4784 [MEDIUM] CVE-2024-4784: gitlab - An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, v... An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2021-22241 [HIGH] CVE-2021-22241: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0. It was possible to exploit a stored cross-site-scripting via a specifically crafted default branch name. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1460 [MEDIUM] CVE-2022-1460: gitlab - An issue has been discovered in GitLab affecting all versions starting from 9.2 ... An issue has been discovered in GitLab affecting all versions starting from 9.2 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not performing correct authorizations on scheduled pipelines allowing a malicious user to run a pipeline in the context of another user. Scope: local sid: resolved (fi