Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: GitLab 17.1.6, 17.2.4, 17.3.1 Clear all filters
TI-2024-02929 CVE-2024-3127 · GHSA-9c64-9pw3-wh7p

Improper Access Control in GitLab

Priority LOW 20

An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00359 Published 2024-08-22 Fixed in 17.1.6, 17.2.4 +1 CWE-284
TI-2024-06031 CVE-2024-6502 · GHSA-j5xm-2wp4-36g2

Incorrect Provision of Specified Functionality in GitLab

Priority LOW 29

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch wit…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0043 Published 2024-08-22 Fixed in 17.1.6, 17.2.4 +1 CWE-684
TI-2024-06584 CVE-2024-7110 · GHSA-px82-82wp-3w57

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

Priority LOW 30

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt in…

CVSS 3.1MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00362 Published 2024-08-22 Fixed in 17.1.6, 17.2.4 +1 CWE-77
TI-2024-07455 CVE-2024-8041 · GHSA-qvhh-qrj8-5g7c

Uncontrolled Resource Consumption in GitLab

Priority LOW 29

A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00462 Published 2024-08-22 Fixed in 17.1.6, 17.2.4 +1 CWE-400