DeutschShown in its original language — a full translation is planned for a future version.
GitLab: Mehrere Schwachstellen
view advisory published 2024-05-21
Ein entfernter Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site-Scripting-Angriff (XSS) durchzuführen, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen oder Sicherheitsmaßnahmen zu umgehen.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-5318US | medium5.3OT elevated | — | ||
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0… | ||||
| CVE-2024-5258US | medium4.3OT elevated | — | ||
An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a… | ||||
| CVE-2024-1947US | medium6.5 | — | ||
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging th… | ||||
| CVE-2023-7045US | medium6.1 | — | ||
A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacke… | ||||
| CVE-2023-6502US | medium6.5 | — | ||
A Denial of Service (DoS) condition has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. It is possible… | ||||
| CVE-2024-4835US | high8.2 | — | ||
A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious… | ||||
| CVE-2024-2874US | medium6.5 | — | ||
An issue has been discovered in GitLab CE/EE affecting all versions before 16.10.6, version 16.11 before 16.11.3, and 17.0 before 17.0.1. A runner registered with a crafted descrip… | ||||
| CVE-2024-4367US | high8.8 | Exploit | ||
A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context. This vulnerability affects Firefox < 126, Firefox ES… | ||||
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan