Gitlab -- vulnerabilities

2024-04-2400:00:00

vuxml.freebsd.org

gitlab

account takeover

path traversal

dos

restricted file read

unauthenticated redos

filefinder

graphql subscriptions

access token

domain restrictions

crafted email address

bitbucket

oauth provider

wildcard filters

project file search

8.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

10.5%

JSON

Gitlab reports:

GitLab account takeover, under certain conditions, when using Bitbucket as an OAuth provider
Path Traversal leads to DoS and Restricted File Read
Unauthenticated ReDoS in FileFinder when using wildcard filters in project file search
Personal Access Token scopes not honoured by GraphQL subscriptions
Domain based restrictions bypass using a crafted email address

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchgitlab-ce= 16.11.0UNKNOWN
FreeBSDanynoarchgitlab-ce< 16.11.1UNKNOWN
FreeBSDanynoarchgitlab-ee= 16.11.0UNKNOWN
FreeBSDanynoarchgitlab-ee< 16.11.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
FreeBSD	any	noarch	gitlab-ce	= 16.11.0	UNKNOWN
FreeBSD	any	noarch	gitlab-ce	< 16.11.1	UNKNOWN
FreeBSD	any	noarch	gitlab-ee	= 16.11.0	UNKNOWN
FreeBSD	any	noarch	gitlab-ee	< 16.11.1	UNKNOWN