This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE/EE fixes 6 vulnerabilities
GitLab fixes 6 vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE) in versions 17.5.2, 17.4.4 and 17.3.7 [1]. The most severe vulnerabilities are listed below.
An authenticated remote attacker can, in a certain configuration of GitLab CE/EE, gain unauthorized access to the Kubernetes agent in the cluster [1][2].
The vulnerability is present in product:
- GitLab; >=16, <17.3.7; >=7.4, <17.4.4; >=17.5, <17.5.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
More information:
- CVE-2024-9693 at cve.org, NVD
- CWE-863: Incorrect Authorization at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
An unauthenticated remote attacker can gain access to the API with the privileges of the victim via the Device OAuth flow component [1][3].
The vulnerability is present in product:
- GitLab; >=17.2, <17.3.7; >=7.4, <17.4.4; >=17.5, <17.5.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
More information:
- CVE-2024-7404 at cve.org, NVD
- CWE-1021: Improper Restriction of Rendered UI Layers or Frames at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
An authenticated remote attacker can carry out a DoS attack by importing a specially crafted file via the Fogbugz component [1].
The vulnerability is present in product:
- GitLab; >=7.4.1, <17.3.7; >=7.4, <17.4.4; >=17.5, <17.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
More information:
- CWE-703: Improper Check or Handling of Exceptional Conditions at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
An unauthenticated remote attacker can carry out an XSS attack via the analytics dashboards section of the website [1][4].
The vulnerability is present in product:
- GitLab; >=16, <17.3.7; >=7.4, <17.4.4; >=17.5, <17.5.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-8648 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 11. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 19. 11. 2024.