GitLab vulnerabilities

GitLab CE/EE versions from 18.6 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an individual with knowledge of a victim's credential ID to bypass two-factor authentication by submitting forged device responses.

GitLab CE/EE versions from 17.7 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to cause a denial of service condition by exploiting incorrect authorization validation in API endpoints.

GitLab CE/EE versions from 11.9 before 18.6.4, 18.7 before 18.7.2, and 18.8 before 18.8.2 contain a vulnerability that could allow an unauthenticated user to create a denial of service condition by sending crafted requests with malformed authentication data.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality.

Multiple versions of GitLab expose a dangerous method that could lead to the deletion of all Issue and MergeRequest objects by any authenticated user. For publicly available projects, this vulnerability could be exploited by unauthenticated users.

The impersonate feature in Gitlab versions 8.7.0, 8.6.0 through 8.6.7, 8.5.0 through 8.5.11, 8.4.0 through 8.4.9, 8.3.0 through 8.3.8, and 8.2.0 through 8.2.4 allows remote authenticated users to 'log in' as any other user via unspecified vectors.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQL directive.

GitLab CE/EE versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user to cause a denial of service affecting background job processing due to missing object count limits.

GitLab EE versions from 11.3 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with project Maintainer permissions to access the terminal of a protected environment they were not authorized to use due to improper authorization checks.

GitLab EE versions from 19.1 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 contain a vulnerability that, under certain conditions, could allow an authenticated user with developer-role permissions to influence the execution environment of Pipeline Execution Policy enforcement jobs due to improper handling of job dependencies.

GitLab CE/EE versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a path traversal vulnerability in the package registry that under certain conditions could allow an authenticated user to achieve remote code execution.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request validation in GraphQL multiplex query handling.

GitLab EE versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to missing authorization checks on a project update endpoint.

GitLab CE/EE versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled values rendered in table cell content by an analytics dashboard component.

GitLab CE/EE versions from 18.2 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a remediated issue that under certain conditions could have allowed cross-site scripting due to improper neutralization of user-controlled data rendered in pagination controls by an analytics dashboard component.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.5 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an unauthenticated user to cause a denial of service due to improper input validation.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

GitLab CE/EE versions from 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

GitLab CE/EE versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.

GitLab CE/EE has an improper access control vulnerability. An authenticated user with guest role could, under certain conditions, access test report contents they were not authorized to view.

GitLab CE/EE has a Cross-Site Scripting (XSS) vulnerability. An attacker can execute arbitrary JavaScript in another user's browser via a crafted URL due to improper input sanitization.

GitLab EE has a vulnerability in virtual registries where sensitive information could be disclosed to an unintended host due to improper handling of upstream requests.

Vulnerability in GitLab CE/EE (versions 11.8 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an unauthenticated user to cause a denial-of-service (DoS) due to insufficient resource throttling when processing merge request discussions.

GitLab EE has an authorization bypass vulnerability during token generation. An authenticated user could bypass administrator-configured tool governance policies.

GitLab EE has a vulnerability in the AI-assisted code review feature. An authenticated user could access information from unauthorized projects due to improper neutralization of untrusted content.

GitLab CE/EE has an authorization check vulnerability. An unauthenticated user could, under certain conditions, view the title of a confidential issue through a publicly accessible merge request.

GitLab CE/EE has an authorization vulnerability in a projects API endpoint. An authenticated user with Maintainer role could modify protected branch configuration due to improper authorization.

Vulnerability in GitLab CE/EE (versions 18.0 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an authenticated user to modify another user's CI/CD configuration due to improper validation of attributes when processing pipeline schedules.

In GitLab CE/EE versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2, a vulnerability in authorization controls on cross-project reference pages allows an unauthenticated user to determine the existence of a private project.

A vulnerability in GitLab CE/EE due to improper sanitization of user-supplied input allows an authenticated user to execute arbitrary scripts in another user's browser session under certain conditions. Affected versions: all from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

A vulnerability in GitLab CE/EE allows an authenticated user to create a repository where the content displayed in the web interface differs from the content available for download. The issue is due to improper handling of Git reference name resolution and affects versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

This CVE has been rejected. GitLab determined that the reported behavior does not constitute a vulnerability: linking a group SAML identity requires explicit user consent, and management of group SAML identities by a group Owner is expected behavior.

A vulnerability in GitLab CE/EE (versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3) allows an authenticated user to invoke unintended server-side methods through WebSocket connections due to improper access control.

In GitLab CE/EE from version 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an authenticated user with custom role permissions can demote or remove higher-privileged group members due to improper authorization checks.

A vulnerability in GitLab CE/EE allows an authenticated user with minimal workspace permissions to obtain Jira Connect installation credentials and impersonate the GitLab app due to improper authorization checks. It affects all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1.

A vulnerability in GitLab CE/EE allows an authenticated user to perform a Stored Cross-Site Scripting (XSS) attack by exploiting GitLab Flavored Markdown. The issue affects versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1.

A vulnerability in GitLab CE/EE allows an unauthenticated attacker to execute arbitrary code in the context of an authenticated user's browser by tricking the user into visiting a specially crafted webpage. The issue affects versions from 18.6 before 18.6.3 and 18.7 before 18.7.1.

An issue has been discovered in GitLab affecting all versions starting from 15.2 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 in which the projects API pagination can be skipped, potentially leading to DoS on certain instances.

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. Due to improper permission validation, it was possible to create model experiments in public projects.

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

An issue has been discovered in GitLab affecting all versions starting from 15.11 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1. An authenticated user could trigger a denial of service when importing or cloning malicious content.

An issue has been discovered in GitLab affecting all versions before 16.2.0. Committing directories containing LF character results in 500 errors when viewing the commit.

An issue has been discovered in GitLab affecting all versions before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2. The main branch of a repository with a specially designed name allows an attacker to create repositories with malicious code.

An issue has been discovered in GitLab affecting all versions from 8.10 before 16.0.8, all versions from 16.1 before 16.1.3, and all versions from 16.2 before 16.2.2. Under specific circumstances, a user importing a project 'from export' could access and read unrelated files via uploading a specially crafted file.