Debian Gitlab vulnerabilities

CVE-2019-20148 [MEDIUM] CVE-2019-20148: gitlab - An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition ... An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) 8.13 through 12.6.1. It has Incorrect Access Control. Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2019-19260 [MEDIUM] CVE-2019-19260: gitlab - GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incor... GitLab Community Edition (CE) and Enterprise Edition (EE) through 12.5 has Incorrect Access Control (issue 2 of 2). Scope: local sid: resolved (fixed in 12.6.8-3)

CVE-2023-0523 [MEDIUM] CVE-2023-0523: gitlab - An issue has been discovered in GitLab affecting all versions starting from 15.6... An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2539 [MEDIUM] CVE-2022-2539: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro... An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-0223 [MEDIUM] CVE-2023-0223: gitlab - An issue has been discovered in GitLab affecting all versions starting from 15.5... An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. Scope: local sid

CVE-2020-12277 [MEDIUM] CVE-2020-12277: gitlab - GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a rep... GitLab 10.8 through 12.9 has a vulnerability that allows someone to mirror a repository even if the feature is not activated. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2024-6595 [LOW] CVE-2024-6595: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 11.... An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data. Scope: local sid: resolved (fixed in 17.3.5-2)

CVE-2024-8650 [MEDIUM] CVE-2024-8650: gitlab - An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior t... An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2024-8116 [MEDIUM] CVE-2024-8116: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 be... An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names. Scope: local sid: resolved (fixed in 17.5.5-1)

CVE-2021-39897 [LOW] CVE-2021-39897: gitlab - Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup ... Improper access control in GitLab CE/EE version 10.5 and above allowed subgroup members with inherited access to a project from a parent group to still have access even after the subgroup is transferred Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13283 [HIGH] CVE-2020-13283: gitlab - For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability e... For GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting vulnerability exists in the issues list via milestone title. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2021-22225 [MEDIUM] CVE-2021-22225: gitlab - Insufficient input sanitization in markdown in GitLab version 13.11 and up allow... Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2021-22206 [MEDIUM] CVE-2021-22206: gitlab - An issue has been discovered in GitLab affecting all versions starting from 11.6... An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text, Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-3018 [MEDIUM] CVE-2022-3018: gitlab - An information disclosure vulnerability in GitLab CE/EE affecting all versions s... An information disclosure vulnerability in GitLab CE/EE affecting all versions starting from 9.3 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 allows a project maintainer to access the DataDog integration API key from webhook logs. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1954 [MEDIUM] CVE-2022-1954: gitlab - A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting a... A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-2500 [MEDIUM] CVE-2022-2500: gitlab - A cross-site scripting issue has been discovered in GitLab CE/EE affecting all v... A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1. A stored XSS flaw in job error messages allows attackers to perform arbitrary actions on behalf of victims at client side. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2020-13330 [MEDIUM] CVE-2020-13330: gitlab - An issue has been discovered in GitLab affecting versions prior to 12.10.13. Git... An issue has been discovered in GitLab affecting versions prior to 12.10.13. GitLab was vulnerable to a stored XSS in import the Bitbucket project feature. Scope: local sid: resolved (fixed in 13.2.3-2)

CVE-2023-1072 [MEDIUM] CVE-2023-1072: gitlab - An issue has been discovered in GitLab affecting all versions starting from 9.0 ... An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details. Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2022-1416 [MEDIUM] CVE-2022-1416: gitlab - Missing sanitization of data in Pipeline error messages in GitLab CE/EE affectin... Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling Scope: local sid: resolved (fixed in 15.10.8+ds1-2)

CVE-2023-4018 [MEDIUM] CVE-2023-4018: gitlab - An issue has been discovered in GitLab affecting all versions starting from 16.2... An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation it was possible to create model experiments in public projects. Scope: local sid: resolved (fixed in 16.4.4+ds2-2)