DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
GitLab: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2020-09-02
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in GitLab ausnutzen, um einen Cross-Site Scripting oder Denial of Service Angriff durchzuführen, Sicherheitsmechanismen zu umgehen, Daten zu manipulieren oder vertrauliche Daten einzusehen.
01
beschreibt (27)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-13308US | low2.7 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. A user without 2 factor authentication enabled could be prohibited from accessing GitLab by bei… | ||||
| CVE-2020-13307US | medium4.7 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 factor authentication was activated allowi… | ||||
| CVE-2020-13303US | medium6.5 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Due to improper verification of permissions, an unauthorized user can access a private reposito… | ||||
| CVE-2020-13315US | high7.5 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentia… | ||||
| CVE-2020-13310US | medium6.5 | — | ||
A vulnerability was discovered in GitLab runner versions before 13.1.3, 13.2.3 and 13.3.1. It was possible to make the gitlab-runner process crash by sending malformed queries, res… | ||||
| CVE-2020-13309US | high8.8 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a blind SSRF attack through the repository mirroring feature. | ||||
| CVE-2020-13306US | high7.5 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Webhook feature could be abused to perform denial of service attacks due to the lack of… | ||||
| CVE-2020-13305US | medium4.3 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not invalidating project invitation link upon removing a user from a project. | ||||
| CVE-2020-13304US | high7.2OT erhöht | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Same 2 factor Authentication secret code was generated which resulted an attacker to maintain a… | ||||
| CVE-2020-13302US | high7.2 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Under certain conditions GitLab was not properly revoking user sessions and allowed a malicious… | ||||
| CVE-2020-13301US | medium4.8 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was vulnerable to a stored XSS on the standalone vulnerability page. | ||||
| CVE-2020-13298US | medium5.8 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Conan package upload functionality was not properly validating the supplied parameters, which r… | ||||
| CVE-2020-13297US | medium5.4 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. When 2 factor authentication was enabled for groups, a malicious user could bypass that restric… | ||||
| CVE-2020-13317US | medium4.9 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8, and 13.3.4. An insufficient check in the GraphQL api allowed a maintainer to delete a repository. | ||||
| CVE-2020-13314US | medium5.3 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab Omniauth endpoint allowed a malicious user to submit content to be displayed back to the… | ||||
| CVE-2020-13313US | medium4.3OT erhöht | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. An unauthorized project maintainer could edit the subgroup badges due to the lack of authorizat… | ||||
| CVE-2020-13312US | critical9.8 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab OAuth endpoint was vulnerable to brute-force attacks through a specific parameter. | ||||
| CVE-2020-13311US | medium4.3 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. Wiki was vulnerable to a parser attack that prohibits anyone from accessing the Wiki functional… | ||||
| CVE-2020-13318US | high7.3 | — | ||
A vulnerability was discovered in GitLab versions before 13.0.12, 13.1.10, 13.2.8 and 13.3.4. GitLabs EKS integration was vulnerable to a cross-account assume role attack. | ||||
| CVE-2020-13316US | medium4.3 | — | ||
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not validating a Deploy-Token and allowed a disabled repository be accessible via a… | ||||
20 von 27 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- GitLab Security Release 13.3.4, 13.2.8, and 13.1.10 vom 2020-09-02external
- openSUSE Security Update OPENSUSE-SU-2025:15130-1 vom 2025-05-18external
- Ubuntu Security Notice USN-4502-1 vom 2020-09-16external
- Ubuntu Security Notice USN-4502-1 vom 2020-09-16external
- WID-SEC-W-2025-1087 - CSAF Versionself
- WID-SEC-2025-1087 - Portal Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan