Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Release: GitLab 17.0.6, 17.1.4, 17.2.2 Clear all filters
TI-2024-02611 CVE-2024-2800 · GHSA-9x8h-2288-5g98

Uncontrolled Resource Consumption in GitLab

Priority LOW 34

ReDoS flaw in RefMatcher when matching branch names using wildcards in GitLab EE/CE affecting all versions from 11.3 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allows denial of service via Regex back…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00705 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-1333
TI-2024-02842 CVE-2024-3035 · GHSA-rvj3-54w6-vrw6

Authorization Bypass Through User-Controlled Key in GitLab

Priority LOW 37

A permission check vulnerability in GitLab CE/EE affecting all versions starting from 8.12 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2 allowed for LFS tokens to read and write to the user owned reposi…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00355 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-639
TI-2024-02916 CVE-2024-3114 · GHSA-m99q-r6r6-wxx3

Uncontrolled Resource Consumption in GitLab

Priority LOW 29

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regu…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00466 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-1333
TI-2024-05039 CVE-2024-5423 · GHSA-q28r-ggr6-763f

Uncontrolled Resource Consumption in GitLab

Priority LOW 29

Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2 which a…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00466 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-400
TI-2024-07002 CVE-2024-7554 · GHSA-8hq6-8c4w-ggxc

Exposure of Sensitive Information to an Unauthorized Actor in GitLab

Priority LOW 29

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9 before 17.0.6, all versions starting from 17.1 before 17.1.4, all versions starting from 17.2 before 17.2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00407 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-200
TI-2024-07054 CVE-2024-7610 · GHSA-f48g-wqmg-9r45

Uncontrolled Resource Consumption in GitLab

Priority LOW 29

A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 15.9 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00452 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-400
TI-2024-03916 CVE-2024-4210 · GHSA-8m4w-86rm-r3rg

Uncontrolled Resource Consumption in GitLab

Priority LOW 29

A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions starting with 12.6 before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00503 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-400
TI-2024-04457 CVE-2024-4784 · GHSA-662c-cj8q-qc4g

Authentication Bypass by Primary Weakness in GitLab

Priority LOW 24

An issue was discovered in GitLab EE starting from version 16.7 before 17.0.6, version 17.1 before 17.1.4 and 17.2 before 17.2.2 that allowed bypassing the password re-entry requirement to approve a policy.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00293 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-305
TI-2024-05873 CVE-2024-6329 · GHSA-vr5w-hwpc-cjqr

Improper Encoding or Escaping of Output in GitLab

Priority LOW 33

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to ren…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00458 Published 2024-08-08 Fixed in 17.0.6, 17.1.4 +1 CWE-116