Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

11 records

Release: GitLab 16.2.8, 16.3.5, 16.4.1 Clear all filters
TI-2023-03191 CVE-2023-3413 · GHSA-v9r7-fcc3-gg2v

Insertion of Sensitive Information Into Sent Data in GitLab

Priority HIGH 66

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00745 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-201
TI-2023-03654 CVE-2023-3922 · GHSA-5h2j-25xj-vggw

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

Priority MEDIUM 64

An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00442 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-601
TI-2023-00938 CVE-2023-0989 · GHSA-p32w-wm8h-w433

Improper Ownership Management in GitLab

Priority LOW 26

An information disclosure issue in GitLab CE/EE affecting all versions starting from 13.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows an attacker to extract non-protected CI/CD variables by tr…

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00503 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-282
TI-2023-02094 CVE-2023-2233 · GHSA-64p4-8fvv-rw89

Missing Authorization in GitLab

Priority LOW 21

An improper authorization issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 16.2.8, all versions starting from 16.3 before 16.3.5 and all versions starting from 16.4 before 16.4.1…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00539 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-862
TI-2023-02920 CVE-2023-3115 · GHSA-5x88-x3vg-442p

Incorrect User Management in GitLab

Priority MEDIUM 58

An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00412 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-286
TI-2023-03653 CVE-2023-3920 · GHSA-qw5x-x275-9wwh

Incorrect Authorization in GitLab

Priority LOW 20

An issue has been discovered in GitLab affecting all versions starting from 11.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00453 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-863
TI-2023-03652 CVE-2023-3917 · GHSA-7jqp-vcg7-7x84

Improper Validation of Specified Type of Input in GitLab

Priority HIGH 66

Denial of Service in pipelines affecting all versions of Gitlab EE and CE prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows attacker to cause pipelines to fail.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00927 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-1287
TI-2023-03650 CVE-2023-3914 · GHSA-6f6c-487w-2449

Incorrect User Management in GitLab

Priority MEDIUM 58

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00432 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-286
TI-2023-03647 CVE-2023-3906 · GHSA-x2v6-6q9m-6qx9

Improper Validation of Specified Type of Input in GitLab

Priority MEDIUM 50

An input validation issue in the asset proxy in GitLab EE, affecting all versions from 12.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1, allowed an authenticated attacker to craft image urls which byp…

CVSS 3.1LOW 3.5 Network Low privileges User interaction EPSS 0.00566 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-1287
TI-2023-03694 CVE-2023-3979 · GHSA-ppjq-2qhc-pjp7

Incorrect Authorization in GitLab

Priority MEDIUM 53

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00475 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-863
TI-2023-04179 CVE-2023-4532 · GHSA-cpg4-gv23-mpmj

Incorrect Authorization in GitLab

Priority MEDIUM 53

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00532 Published 2023-09-29 Fixed in 16.2.8, 16.3.5 +1 CWE-863