Debian Gitlab vulnerabilities

CVE-2023-3906 [LOW] CVE-2023-3906: gitlab - An input validation issue in the asset proxy in GitLab EE, affecting all version... An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which bypass the asset proxy. Scope: local sid: resolved

CVE-2023-2825 [CRITICAL] CVE-2023-2825: gitlab - An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An u... An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. Scope: local sid: resolved

CVE-2023-5106 [HIGH] CVE-2023-5106: gitlab - An issue has been discovered in Ultimate-licensed GitLab EE affecting all versio... An issue has been discovered in Ultimate-licensed GitLab EE affecting all versions starting 13.12 prior to 16.2.8, 16.3.0 prior to 16.3.5, and 16.4.0 prior to 16.4.1 that could allow an attacker to impersonate users in CI pipelines through direct transfer group imports. Scope: local sid: resolved

CVE-2023-1621 [MEDIUM] CVE-2023-1621: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address. Scope: local sid: resolved

CVE-2023-0120 [LOW] CVE-2023-0120: gitlab - An issue has been discovered in GitLab affecting all versions starting from 10.0... An issue has been discovered in GitLab affecting all versions starting from 10.0 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to edit labels description by an unauthorised user. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)

CVE-2023-4379 [HIGH] CVE-2023-4379: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated. Scope: local sid: resolved

CVE-2023-3914 [MEDIUM] CVE-2023-3914: gitlab - A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3... A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects. Scope: local sid: resolved

CVE-2023-4895 [MEDIUM] CVE-2023-4895: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1... An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This vulnerability allows for bypassing the 'group ip restriction' settings to access environment details of projects Scope: local sid: resolved

CVE-2023-4011 [MEDIUM] CVE-2023-4011: gitlab - An issue has been discovered in GitLab EE affecting all versions from 15.11 prio... An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS. Scope: local sid: resolved

CVE-2022-3572 [CRITICAL] CVE-2022-3572: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v... A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims. Scope: loca

CVE-2022-2884 [CRITICAL] CVE-2022-2884: gitlab - A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1... A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2992 [CRITICAL] CVE-2022-2992: gitlab - A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.... A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1162 [CRITICAL] CVE-2022-1162: gitlab - A hardcoded password was set for accounts registered using an OmniAuth provider ... A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-0735 [CRITICAL] CVE-2022-0735: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands. Scope: local sid: resolved

CVE-2022-1680 [CRITICAL] CVE-2022-1680: gitlab - An account takeover issue has been discovered in GitLab EE affecting all version... An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary

CVE-2022-2185 [CRITICAL] CVE-2022-2185: gitlab - A critical issue has been discovered in GitLab affecting all versions starting f... A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1423 [HIGH] CVE-2022-1423: gitlab - Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting a... Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches Scope: local sid: resol

CVE-2022-3265 [HIGH] CVE-2022-3265: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v... A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Scope: local sid

CVE-2022-2229 [HIGH] CVE-2022-2229: gitlab - An improper authorization issue in GitLab CE/EE affecting all versions from 13.7... An improper authorization issue in GitLab CE/EE affecting all versions from 13.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to extract the value of an unprotected variable they know the name of in public projects or private projects they're a member of. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-3060 [HIGH] CVE-2022-3060: gitlab - Improper control of a resource identifier in Error Tracking in GitLab CE/EE affe... Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests Scope: local sid: resolved (fixed in 15.10.8+ds1-2)