This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE and EE fix 2 vulnerabilities
GitLab fixes 2 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products in versions 16.8.5, 16.9.3 and 16.10.1 [1][2].
An authenticated remote attacker can cause a DoS attack by using specially crafted descriptions for labels [1].
The vulnerability is present in product:
- GitLab; <16.8.5; >=16.9.0, <16.9.3; >= 16.10.0, <16.10.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
More information:
- CVE-2024-2818 at cve.org, NVD
- CWE-400 at cwe.mitre.org
The vulnerability was publicly disclosed 28. 3. 2024.
An authenticated remote attacker can carry out a stored XSS attack on a wiki page [2].
The vulnerability is present in product:
- GitLab; <16.8.5; >=16.9.0, <16.9.3; >= 16.10.0, <16.10.1;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2023-6371 at cve.org, NVD
- CWE-79 at cwe.mitre.org
The vulnerability was publicly disclosed 28. 3. 2024.
Links
By CESNET, z.s.p.o. Martin Krajči on 28. 3. 2024.