CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Gitlab : Security Vulnerabilities

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-2825 22 Dir. Trav. 2023-05-26 2023-05-29
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting only version 16.0.0. An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.
2 CVE-2023-2478 732 2023-05-08 2023-05-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.9.7, all versions starting from 15.10 before 15.10.6, all versions starting from 15.11 before 15.11.2. Under certain conditions, a malicious unauthorized GitLab user may use a GraphQL endpoint to attach a malicious runner to any project.
3 CVE-2023-2182 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.
4 CVE-2023-2181 2023-05-12 2023-05-26
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions before 15.9.8, 15.10.0 before 15.10.7, and 15.11.0 before 15.11.3. A malicious developer could use a git feature called refs/replace to smuggle content into a merge request which would not be visible during review in the UI.
5 CVE-2023-2069 668 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with the role of developer could use the import project feature to leak CI/CD variables.
6 CVE-2023-1965 352 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.
7 CVE-2023-1836 79 XSS 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances
8 CVE-2023-1787 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A search timeout could be triggered if a specific HTML payload was used in the issue description.
9 CVE-2023-1733 DoS 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
A denial of service condition exists in the Prometheus server bundled with GitLab affecting all versions from 11.10 to 15.8.5, 15.9 to 15.9.4 and 15.10 to 15.10.1.
10 CVE-2023-1710 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
A sensitive information disclosure vulnerability in GitLab affecting all versions from 15.0 prior to 15.8.5, 15.9 prior to 15.9.4 and 15.10 prior to 15.10.1 allows an attacker to view the count of internal notes for a given issue.
11 CVE-2023-1708 77 Exec Code 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue was identified in GitLab CE/EE affecting all versions from 1.0 prior to 15.8.5, 15.9 prior to 15.9.4, and 15.10 prior to 15.10.1 where non-printable characters gets copied from clipboard, allowing unexpected commands to be executed on victim machine.
12 CVE-2023-1417 863 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible for an unauthorised user to add child epics linked to victim's epic in an unrelated group.
13 CVE-2023-1265 384 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.
14 CVE-2023-1204 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.
15 CVE-2023-1178 94 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be compromised when source code or installation packages are pulled from a tag or from a release containing a ref to another commit.
16 CVE-2023-1167 862 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
Improper authorization in Gitlab EE affecting all versions from 12.3.0 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 allows an unauthorized access to security reports in MR.
17 CVE-2023-1098 +Info 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An information disclosure vulnerability has been discovered in GitLab EE/CE affecting all versions starting from 11.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1 will allow an admin to leak password from repository mirror configuration.
18 CVE-2023-1084 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A malicious project Maintainer may create a Project Access Token with Owner level privileges using a crafted request.
19 CVE-2023-1072 400 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.
20 CVE-2023-1071 863 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.
21 CVE-2023-0838 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting versions starting from 15.1 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. A maintainer could modify a webhook URL to leak masked webhook secrets by adding a new parameter to the url. This addresses an incomplete fix for CVE-2022-4342.
22 CVE-2023-0805 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner.
23 CVE-2023-0756 Exec Code 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository with a specially crafted name allows an attacker to create repositories with malicious code, victims who clone or download these repositories will execute arbitrary code on their systems.
24 CVE-2023-0523 79 XSS 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1. An XSS was possible via a malicious email address for certain instances.
25 CVE-2023-0518 2023-02-13 2023-02-27
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. It was possible to trigger a DoS attack by uploading a malicious Helm chart.
26 CVE-2023-0485 668 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 13.11 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible that a project member demoted to a user role to read project updates by doing a diff with a pre-existing fork.
27 CVE-2023-0483 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site.
28 CVE-2023-0450 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 8.1 to 15.8.5, and from 15.9 to 15.9.4, and from 15.10 to 15.10.1. It was possible to add a branch with an ambiguous name that could be used to social engineer users.
29 CVE-2023-0326 2023-03-27 2023-04-03
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headers was leaked in vulnerability report evidence.
30 CVE-2023-0319 863 2023-04-05 2023-04-12
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.
31 CVE-2023-0223 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.
32 CVE-2023-0155 601 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions before 15.8.5, 15.9.4, 15.10.1. Open redirects was possible due to framing arbitrary content on any page allowing user controlled markdown
33 CVE-2023-0050 79 XSS 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
34 CVE-2023-0042 601 2023-01-12 2023-01-20
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
35 CVE-2022-4462 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
36 CVE-2022-4376 2023-05-03 2023-05-09
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.
37 CVE-2022-4365 2023-01-12 2023-01-20
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak the sentry token by changing the configured URL in the Sentry error tracking settings page.
38 CVE-2022-4342 2023-01-12 2023-01-18
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A malicious Maintainer can leak masked webhook secrets by changing target URL of the webhook.
39 CVE-2022-4335 918 2023-01-27 2023-02-06
0.0
 None ??? ??? ??? ??? ??? ???
A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker to connect to a local host.
40 CVE-2022-4331 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group.
41 CVE-2022-4317 601 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.
42 CVE-2022-4315 863 2023-03-08 2023-03-22
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.
43 CVE-2022-4289 2023-03-09 2023-03-15
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users.
44 CVE-2022-4255 2023-01-27 2023-02-06
0.0
 None ??? ??? ??? ??? ??? ???
An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.
45 CVE-2022-4206 +Info 2023-02-01 2023-02-07
0.0
 None ??? ??? ??? ??? ??? ???
A sensitive information leak issue has been discovered in all versions of DAST API scanner from 1.6.50 prior to 2.0.102, exposing the Authorization header in the vulnerability report
46 CVE-2022-4205 843 2023-01-27 2023-02-06
0.0
 None ??? ??? ??? ??? ??? ???
In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
47 CVE-2022-4201 918 2023-01-27 2023-02-06
0.0
 None ??? ??? ??? ??? ??? ???
A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
48 CVE-2022-4167 863 2023-01-12 2023-01-18
0.0
 None ??? ??? ??? ??? ??? ???
Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group access tokens to continue working even after the group owner loses the ability to revoke them.
49 CVE-2022-4138 352 CSRF 2023-02-13 2023-02-27
0.0
 None ??? ??? ??? ??? ??? ???
A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project.
50 CVE-2022-4131 1333 DoS 2023-01-12 2023-01-18
0.0
 None ??? ??? ??? ??? ??? ???
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents.
Total number of vulnerabilities : 145   Page : 1 (This Page)2 3
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.