Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)

1) Missing Authorization

EUVDB-ID: #VU100973

Risk: Medium

CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-8114

CWE-ID: CWE-862 - Missing Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to missing authorization within LFS Tokens, which leads to security restrictions bypass and privilege escalation.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 8.12 - 17.6.0

GitLab Enterprise Edition: 8.12.0 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:8.12:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:8.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:8.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:8.12.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:8.12.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:8.12.2:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/480494
http://hackerone.com/reports/2649822

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Inefficient Algorithmic Complexity

EUVDB-ID: #VU100974

Risk: Medium

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-8237

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to inefficient algorithmic complexity. A remote user can use a specially crafted cargo.toml file and cause a denial of service condition on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 0.1.5 - 17.6.0

GitLab Enterprise Edition: 6.2.0 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:0.1.5:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:0.8.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:0.9.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:6.2.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:6.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:6.4.0:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/480900
http://hackerone.com/reports/2648665

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incorrect authorization

EUVDB-ID: #VU100975

Risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-11669

CWE-ID: CWE-863 - Incorrect Authorization

Exploit availability: No

Description

The vulnerability allows a remote user to bypass authorization checks.

The vulnerability exists due to overly broad application of token scopes. A remote administrator can gain unauthorized access to sensitive data.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 16.9.8 - 17.6.0

GitLab Enterprise Edition: 16.9.8 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:16.9.8:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:16.9.9:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:16.9.10:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.9.8:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.9.9:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.9.10:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/501528

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Input validation error

EUVDB-ID: #VU100976

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-8177

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within Harbor registry integration. A remote user can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 15.6.0 - 17.6.0

GitLab Enterprise Edition: 15.6.0 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:15.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:15.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:15.6.2:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:15.6.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:15.6.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:15.6.2:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/480706
http://hackerone.com/reports/2637996

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Insufficient Session Expiration

EUVDB-ID: #VU100977

Risk: Low

CVSSv3.1: 3.7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-11668

CWE-ID: CWE-613 - Insufficient Session Expiration

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient session expiration issue. A remote user can gain unauthorized access to streaming results.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 16.11.0 - 17.6.0

GitLab Enterprise Edition: 16.11.0 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:16.11.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:16.11.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:16.11.2:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.11.0:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.11.1:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:16.11.2:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/456922

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Resource exhaustion

EUVDB-ID: #VU100978

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-11828

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within test_report API calls. A remote user can trigger resource exhaustion and perform a denial of service (DoS) attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Gitlab Community Edition: 13.2.4 - 17.6.0

GitLab Enterprise Edition: 13.2.4 - 17.6.0

CPE2.3

• cpe:2.3:a:gitlab:gitlab:13.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:13.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab:13.2.6:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:13.2.4:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:13.2.5:*:*:*:*:*:*:*
• cpe:2.3:a:gitlab:gitlab-ee:13.2.6:*:*:*:*:*:*:*

External links

http://gitlab.com/gitlab-org/gitlab/-/issues/443559
http://hackerone.com/reports/2380264

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.