GitLab vulnerabilities

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

GitLab CE/EE versions from 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to escalate privileges due to improper sanitization of HTML content rendered in a CI job modal.

GitLab CE/EE versions from 19.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 have a vulnerability that under certain conditions could allow an authenticated user with developer-role permissions to execute CI/CD pipelines on a protected branch without the required push permissions due to improper authorization in pipeline reference validation.

GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.

GitLab CE/EE has an improper access control vulnerability. An authenticated user with guest role could, under certain conditions, access test report contents they were not authorized to view.

GitLab CE/EE has a Cross-Site Scripting (XSS) vulnerability. An attacker can execute arbitrary JavaScript in another user's browser via a crafted URL due to improper input sanitization.

GitLab EE has a vulnerability in virtual registries where sensitive information could be disclosed to an unintended host due to improper handling of upstream requests.

Vulnerability in GitLab CE/EE (versions 11.8 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an unauthenticated user to cause a denial-of-service (DoS) due to insufficient resource throttling when processing merge request discussions.

GitLab EE has an authorization bypass vulnerability during token generation. An authenticated user could bypass administrator-configured tool governance policies.

GitLab EE has a vulnerability in the AI-assisted code review feature. An authenticated user could access information from unauthorized projects due to improper neutralization of untrusted content.

GitLab CE/EE has an authorization check vulnerability. An unauthenticated user could, under certain conditions, view the title of a confidential issue through a publicly accessible merge request.

GitLab CE/EE has an authorization vulnerability in a projects API endpoint. An authenticated user with Maintainer role could modify protected branch configuration due to improper authorization.

Vulnerability in GitLab CE/EE (versions 18.0 through 19.0.4, 19.1.0-19.1.2, 19.2.0-19.2.0) allows an authenticated user to modify another user's CI/CD configuration due to improper validation of attributes when processing pipeline schedules.

In GitLab CE/EE versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2, a vulnerability in authorization controls on cross-project reference pages allows an unauthenticated user to determine the existence of a private project.

A vulnerability in GitLab CE/EE due to improper sanitization of user-supplied input allows an authenticated user to execute arbitrary scripts in another user's browser session under certain conditions. Affected versions: all from 15.7 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

A vulnerability in GitLab CE/EE allows an authenticated user to create a repository where the content displayed in the web interface differs from the content available for download. The issue is due to improper handling of Git reference name resolution and affects versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2.

This CVE has been rejected. GitLab determined that the reported behavior does not constitute a vulnerability: linking a group SAML identity requires explicit user consent, and management of group SAML identities by a group Owner is expected behavior.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain conditions could have allowed an authenticated user to access CI data from a different ref type than intended.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.2 before 18.9.6, 18.10 before 18.10.4, and 18.11 before 18.11.1 that under certain conditions could have allowed an authenticated user with project owner permissions to bypass group fork prevention settings due to improper authorization checks.

A vulnerability in GitLab CE/EE (versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3) allows an authenticated user to invoke unintended server-side methods through WebSocket connections due to improper access control.

In GitLab CE/EE from version 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3, an authenticated user with custom role permissions can demote or remove higher-privileged group members due to improper authorization checks.

A vulnerability in GitLab CE/EE allows an authenticated user with minimal workspace permissions to obtain Jira Connect installation credentials and impersonate the GitLab app due to improper authorization checks. It affects all versions from 14.3 before 18.8.7, 18.9 before 18.9.3, and 18.10 before 18.10.1.

A vulnerability in GitLab CE/EE allows an authenticated user to perform a Stored Cross-Site Scripting (XSS) attack by exploiting GitLab Flavored Markdown. The issue affects versions from 18.2.2 before 18.5.5, 18.6 before 18.6.3, and 18.7 before 18.7.1.

A vulnerability in GitLab CE/EE allows an unauthenticated attacker to execute arbitrary code in the context of an authenticated user's browser by tricking the user into visiting a specially crafted webpage. The issue affects versions from 18.6 before 18.6.3 and 18.7 before 18.7.1.

GitLab CE/EE versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 contain a vulnerability that could, under certain circumstances, allow an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI.

GitLab CE/EE versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 contain a vulnerability that could have allowed an authenticated user to perform unauthorized actions on behalf of other users by injecting malicious HTML into vulnerability code flow displays.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an authenticated user to cause a Denial of Service condition by sending crafted API calls with large content parameters.

GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by creating wiki pages with malicious content. GitLab has remediated this issue.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed an unauthenticated user to create a denial of service condition by sending crafted GraphQL queries that bypass query complexity limits.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 prior to 18.4.5, 18.5 prior to 18.5.3, and 18.6 prior to 18.6.1 that could have allowed an authenticated user to obtain credentials from higher-privileged users and perform actions in their context under specific conditions.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed an authenticated user with specific permissions to cause a denial of service condition through HTTP response processing.

GitLab CE/EE in all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 contained an issue that could allow an authenticated user with access to certain logs to obtain sensitive tokens under specific conditions. The vendor fixed the issue in versions 18.5.5 and 18.6.3.

GitLab CE/EE versions 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 contain an issue that under specific conditions could allow an unauthenticated user to join arbitrary organizations by changing headers on some requests.

GitLab CE/EE contains a vulnerability that could allow an unauthenticated user to cause a denial-of-service (DoS) condition by sending crafted requests containing malicious JSON payloads. The issue affects the specified version ranges before fixes.

GitLab CE/EE versions from 13.7 to 18.2.8, 18.3 before 18.3.4, and 18.4 before 18.4.2 contain a flaw that allows authenticated users without project membership to view sensitive manual CI/CD variables by querying the GraphQL API.

In GitLab CE/EE (versions from 16.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2), an authenticated attacker could cause a denial of service by submitting specially crafted markdown content with nested formatting patterns. The vendor has remediated the issue.

GitLab CE/EE versions from 17.6 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 contain an issue that, under specific conditions, could allow unauthorized users to view confidential branch names by accessing project issues with related merge requests.

GitLab CE/EE versions from 13.2 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 allowed an authenticated attacker with reporter access to view branch names and pipeline details via the packages API endpoint even when repository access was disabled.

GitLab CE/EE versions from 16.7 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 allowed a blocked user to access sensitive information by establishing GraphQL subscriptions through WebSocket connections.

GitLab EE contains a vulnerability that could allow an authenticated attacker with specific permissions to hijack project runners from other projects. The issue affects versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.7 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to create a denial of service condition by uploading large files to specific API endpoints.

A vulnerability in GitLab CE/EE (all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1). An unauthenticated attacker could cause a denial of service (DoS) by sending GraphQL requests with crafted JSON payloads.

GitLab CE/EE contains a vulnerability that could allow an unauthenticated attacker to cause a denial of service condition by sending specially crafted payloads. The issue affects versions from 17.10 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1.

GitLab CE/EE in all versions from 5.2 prior to 18.2.8, 18.3 prior to 18.3.4, and 18.4 prior to 18.4.2 could allow an authenticated attacker to create a denial of service condition by configuring malicious webhook endpoints that send crafted HTTP responses.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.12 to 18.2.8, 18.3 to 18.3.4, and 18.4 to 18.4.2 that could make the GitLab instance unresponsive or severely degraded by sending crafted GraphQL queries requesting large repository blobs.

A Denial of Service vulnerability in GraphQL endpoints in GitLab EE/CE allows unauthenticated users to potentially bypass query complexity limits, leading to resource exhaustion and service disruption. The issue affects versions from 11.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

An authenticated user in GitLab CE/EE could gain unauthorized access to confidential issues by creating a project with the same name as the victim's project. It affects versions from 17.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1. It allows an attacker to cause uncontrolled CPU consumption via specific GraphQL queries, potentially leading to a Denial of Service (DoS) condition.

A performance degradation issue was discovered in GitLab CE/EE string conversion methods when handling large inputs. It affects versions from 17.4 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1.

GitLab CE/EE versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 allowed Guest users to access sensitive information stored in virtual registry configurations.