This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE and EE fix 6 vulnerabilities
GitLab fixes 6 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products with versions 17.2.1, 17.1.3 and 17.0.5 [1].
An authenticated remote attacker is allowed to carry out an XSS attack [1].
The vulnerability is present in product:
- GitLab; >=16.6, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An authenticated remote attacker with developer privileges is allowed to access information concerning some settings [1].
The vulnerability is present in product:
- GitLab; >=16.11, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
More information:
- CVE-2024-5067 at cve.org, NVD
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An authenticated remote attacker is allowed to access job outputs (job artifacts) without authorization [1].
The vulnerability is present in product:
- GitLab; >=16.7, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2024-7057 at cve.org, NVD
- CWE-284: Improper Access Control at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An authenticated remote attacker is allowed to access a limited amount of information without authorization [1].
The vulnerability is present in product:
- GitLab; >=12:0, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
More information:
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An authenticated remote attacker is allowed to influence the writing of commits [1].
The vulnerability is present in product:
- GitLab; >=12.0, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
More information:
- CVE-2024-0231 at cve.org, NVD
- CWE-99: Improper Control of Resource Identifiers ('Resource Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
An authenticated remote attacker is allowed to access information without authorization [1].
The vulnerability is present in product:
- GitLab; >=15.4, <17.0.5; >=17.1, <17.1.3; >=17.2, <17.2.1;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
More information:
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor at cwe.mitre.org
The vulnerability was publicly disclosed 24. 7. 2024.
By CESNET, z.s.p.o. Martin Krajči on 25. 7. 2024.