Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)

1) Open redirect

EUVDB-ID: #VU74251

Risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0155

CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Exploit availability: No

Description

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote user can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.7.0 - 15.10.0

GitLab Enterprise Edition: 15.7.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Information disclosure

EUVDB-ID: #VU74257

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3375

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can disclose the branch names when has a fork of a project that was switched to private.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 11.10.0 - 15.10.0

GitLab Enterprise Edition: 11.10.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU74256

Risk: Low

CVSSv3.1: 2.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1071

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper permissions checks. A remote user can remove an issue from an epic.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.5.0 - 15.10.0

GitLab Enterprise Edition: 15.5.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper access control

EUVDB-ID: #VU74255

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0450

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can add a branch with an ambiguous name that could be used to social engineer users.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 8.1 - 15.10.0

GitLab Enterprise Edition: 8.1.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Information disclosure

EUVDB-ID: #VU74254

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1710

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can view the count of internal notes for a given issue.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.0.0 - 15.10.0

GitLab Enterprise Edition: 15.0.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Improper access control

EUVDB-ID: #VU74253

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1417

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can add child epics linked to a victim's epic in an unrelated group.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 0.1.5 - 15.10.0

GitLab Enterprise Edition: 6.2.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper Authorization

EUVDB-ID: #VU74252

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1167

CWE-ID: CWE-285 - Improper Authorization

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authorization checks.

The vulnerability exists due to improper authorization. A remote attacker can gain access to security reports in merge requests.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 12.3.0 - 15.10.0

GitLab Enterprise Edition: 12.3.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Stored cross-site scripting

EUVDB-ID: #VU74250

Risk: Low

CVSSv3.1: 5.6 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0523

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data when :soft_email_confirmation feature flag is enabled. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.6.0 - 15.10.0

GitLab Enterprise Edition: 15.6.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Information disclosure

EUVDB-ID: #VU74249

Risk: Low

CVSSv3.1: 4.8 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0838

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote administrator can leak masked webhook secrets by adding a new parameter to the webhook URL.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.1.0 - 15.10.0

GitLab Enterprise Edition: 15.1.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Command Injection

EUVDB-ID: #VU74248

Risk: Medium

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1708

CWE-ID: CWE-77 - Command injection

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to non-printable characters are copied from clipboard. A remote user can pass specially crafted data to the application and execute arbitrary commands on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 0.1.5 - 15.10.0

GitLab Enterprise Edition: 6.2.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Information disclosure

EUVDB-ID: #VU74247

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0319

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can view environment names from public projects limited to project members only.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.6.0 - 15.10.0

GitLab Enterprise Edition: 13.6.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Resource exhaustion

EUVDB-ID: #VU74246

Risk: Medium

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1733

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in the Prometheus server. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 11.10.0 - 15.10.0

GitLab Enterprise Edition: 11.10.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Information disclosure

EUVDB-ID: #VU74245

Risk: Low

CVSSv3.1: 5.1 [CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-1098

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote administrator can leak password from repository mirror configuration.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 11.5.0 - 15.10.0

GitLab Enterprise Edition: 11.5.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Information disclosure

EUVDB-ID: #VU74244

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2023-0485

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote user can read project updates by doing a diff with a pre-existing fork.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.11.0 - 15.10.0

GitLab Enterprise Edition: 13.11.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Cross-site scripting

EUVDB-ID: #VU74243

Risk: Low

CVSSv3.1: 5.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-3513

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in the "Maximum page reached" page. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 12.8.0 - 15.10.0

GitLab Enterprise Edition: 12.8.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper access control

EUVDB-ID: #VU74258

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can trigger a search timeout if a specific HTML payload is used in the issue description.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.9.0 - 15.10.0

GitLab Enterprise Edition: 15.9.0 - 15.10.0

External links

http://about.gitlab.com/releases/2023/03/30/security-release-gitlab-15-10-1-released/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.