GitLab GitLab Version Control Server and CI/CD Platform

Do you want an email whenever new security vulnerabilities are reported in GitLab?

By the Year

In 2021 there have been 61 vulnerabilities in GitLab with an average score of 5.8 out of ten. Last year GitLab had 235 security vulnerabilities published. Right now, GitLab is on track to have less security vulnerabilities in 2021 than it did last year. Last year, the average CVE base score was greater by 0.38

Year Vulnerabilities Average Score
2021 61 5.76
2020 235 6.14
2019 164 6.23
2018 33 7.06

It may take a day or so for new GitLab vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.

Recent GitLab Security Vulnerabilities

An information disclosure vulnerability in GitLab EE versions 13.10 and later

CVE-2021-22233 4.3 - Medium - July 07, 2021

An information disclosure vulnerability in GitLab EE versions 13.10 and later allowed a user to read project details

Information Disclosure

Insufficient input sanitization in markdown in GitLab version 13.11 and up

CVE-2021-22225 5.4 - Medium - July 07, 2021

Insufficient input sanitization in markdown in GitLab version 13.11 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown

XSS

A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2

CVE-2021-22224 6.5 - Medium - July 07, 2021

A cross-site request forgery vulnerability in the GraphQL API in GitLab since version 13.12 and before versions 13.12.6 and 14.0.2 allowed an attacker to call mutations as the victim

Session Riding

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0

CVE-2021-22231 4.3 - Medium - July 07, 2021

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username.

Improper code rendering while rendering merge requests could be exploited to submit malicious code

CVE-2021-22230 7.2 - High - July 07, 2021

Improper code rendering while rendering merge requests could be exploited to submit malicious code. This vulnerability affects GitLab CE/EE 9.3 and later through 13.11.6, 13.12.6, and 14.0.2.

A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2

CVE-2021-22227 6.1 - Medium - July 07, 2021

A reflected cross-site script vulnerability in GitLab before versions 13.11.6, 13.12.6 and 14.0.2 allowed an attacker to send a malicious link to a victim and trigger actions on their behalf if they clicked it

XSS

An issue has been discovered in GitLab affecting all versions

CVE-2021-22228 6.5 - Medium - July 06, 2021

An issue has been discovered in GitLab affecting all versions. Improper access control allows unauthorised users to access project details using Graphql.

authentification

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9

CVE-2021-22223 6.1 - Medium - July 06, 2021

Client-Side code injection through Feature Flag name in GitLab CE/EE starting with 11.9 allows a specially crafted feature flag name to PUT requests on behalf of other users via clicking on a link

XSS

HTML injection was possible

CVE-2021-22232 5.4 - Medium - July 06, 2021

HTML injection was possible via the full name field before versions 13.11.6, 13.12.6, and 14.0.2 in GitLab CE

Injection

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8

CVE-2021-22229 7.5 - High - July 06, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.8. Under a special condition it was possible to access data of an internal repository through project fork done by a project member.

Under certain conditions, some users were able to push to protected branches

CVE-2021-22226 6.5 - Medium - July 06, 2021

Under certain conditions, some users were able to push to protected branches that were restricted to deploy keys in GitLab CE/EE since version 13.9

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability

CVE-2021-32823 3.7 - Low - June 24, 2021

In the bindata RubyGem before version 2.4.10 there is a potential denial-of-service vulnerability. In affected versions it is very slow for certain classes in BinData to be created. For example BinData::Bit100000, BinData::Bit100001, BinData::Bit100002, BinData::Bit<N>. In combination with <user_input>.constantize there is a potential for a CPU-based DoS. In version 2.4.10 bindata improved the creation time of Bits and Integers.

Resource Exhaustion

A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8

CVE-2021-22181 6.5 - Medium - June 11, 2021

A denial of service vulnerability in GitLab CE/EE affecting all versions since 11.8 allows an attacker to create a recursive pipeline relationship and exhaust resources.

Resource Exhaustion

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting

CVE-2021-22175 9.8 - Critical - June 11, 2021

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is disabled

XSPA

An issue has been discovered in GitLab affecting all versions starting with 13.10

CVE-2021-22220 6.1 - Medium - June 08, 2021

An issue has been discovered in GitLab affecting all versions starting with 13.10. GitLab was vulnerable to a stored XSS in blob viewer of notebooks.

XSS

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5

CVE-2021-22216 6.5 - Medium - June 08, 2021

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a very long issue or merge request description

Resource Exhaustion

GitLab CE/EE since version 9.5

CVE-2021-22219 4.9 - Medium - June 08, 2021

GitLab CE/EE since version 9.5 allows a high privilege user to obtain sensitive information from log files because the sensitive information was not correctly registered for log masking.

Insertion of Sensitive Information into Log File

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5

CVE-2021-22217 6.5 - Medium - June 08, 2021

A denial of service vulnerability in all versions of GitLab CE/EE before 13.12.2, 13.11.5 or 13.10.5 allows an attacker to cause uncontrolled resource consumption with a specially crafted issue or merge request

Resource Exhaustion

A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10

CVE-2021-22213 6.5 - Medium - June 08, 2021

A cross-site leak vulnerability in the OAuth flow of all versions of GitLab CE/EE since 7.10 allowed an attacker to leak an OAuth access token by getting the victim to visit a malicious page with Safari

Information Disclosure

An issue has been discovered in GitLab affecting all versions starting

CVE-2021-22221 6.5 - Medium - June 08, 2021

An issue has been discovered in GitLab affecting all versions starting from 12.9.0 before 13.10.5, all versions starting from 13.11.0 before 13.11.5, all versions starting from 13.12.0 before 13.12.2. Insufficient expired password validation in various operations allow user to maintain limited access after their password expired

Insufficient Session Expiration

An information disclosure vulnerability in GitLab EE versions 13.11 and later

CVE-2021-22215 2.7 - Low - June 08, 2021

An information disclosure vulnerability in GitLab EE versions 13.11 and later allowed a project owner to leak information about the members' on-call rotations in other projects

Exposure of Resource to Wrong Sphere

All versions of GitLab CE/EE starting with 12.8 were affected by an issue in the handling of x509 certificates

CVE-2021-22218 2.6 - Low - June 08, 2021

All versions of GitLab CE/EE starting with 12.8 were affected by an issue in the handling of x509 certificates that could be used to spoof author of signed commits.

Improper Certificate Validation

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting

CVE-2021-22214 8.6 - High - June 08, 2021

When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab CE/EE affecting all versions starting from 10.5 was possible to exploit for an unauthenticated attacker even on a GitLab instance where registration is limited

XSPA

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2

CVE-2021-22210 5.3 - Medium - May 06, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2. When querying the repository branches through API, GitLab was ignoring a query parameter and returning a considerable amount of results.

Allocation of Resources Without Limits or Throttling

An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7

CVE-2021-22208 4.3 - Medium - May 06, 2021

An issue has been discovered in GitLab affecting versions starting with 13.5 up to 13.9.7. Improper permission check could allow the change of timestamp for issue creation or update.

AuthZ

An issue has been discovered in GitLab affecting all versions starting from 11.6

CVE-2021-22206 4.9 - Medium - May 06, 2021

An issue has been discovered in GitLab affecting all versions starting from 11.6. Pull mirror credentials are exposed that allows other maintainers to be able to view the credentials in plain-text,

Cleartext Storage of Sensitive Information

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8

CVE-2021-22209 7.5 - High - May 06, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.8. GitLab was not properly validating authorisation tokens which resulted in GraphQL mutation being executed.

AuthZ

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7

CVE-2021-22211 4.3 - Medium - May 06, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7. GitLab Dependency Proxy, under certain circumstances, can impersonate a user resulting in possibly incorrect access handling.

AuthZ

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9

CVE-2021-22205 9.9 - Critical - April 23, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properly validating image files that were passed to a file parser which resulted in a remote command execution.

Improper Input Validation

An issue has been discovered in GitLab affecting all versions starting with 12.9

CVE-2021-22199 5.4 - Medium - April 22, 2021

An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used.

XSS

A path traversal vulnerability

CVE-2021-22190 6.5 - Medium - April 12, 2021

A path traversal vulnerability via the GitLab Workhorse in all versions of GitLab could result in the leakage of a JWT token

Directory traversal

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4

CVE-2021-22196 5.4 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

XSS

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4

CVE-2021-22196 5.4 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4. It was possible to exploit a stored cross-site-scripting in merge request via a specifically crafted branch name.

XSS

An issue has been discovered in GitLab CE/EE affecting all versions starting

CVE-2021-22197 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

Infinite Loop

An issue has been discovered in GitLab CE/EE affecting all versions starting

CVE-2021-22197 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 where an infinite loop exist when an authenticated user with specific rights access a MR having source and target branch pointing to each other

Infinite Loop

An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above

CVE-2021-22198 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.

An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above

CVE-2021-22198 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions from 13.8 and above allowing an authenticated user to delete incident metric images of public projects.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9

CVE-2021-22201 6.5 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9

CVE-2021-22201 6.5 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.9. A specially crafted import file could read files on the server.

An issue has been discovered in GitLab CE/EE affecting all versions starting with 13.7.9

CVE-2021-22203 7.5 - High - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting with 13.7.9. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

An issue has been discovered in GitLab CE/EE affecting all versions starting with 13.7.9

CVE-2021-22203 7.5 - High - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting with 13.7.9. A specially crafted Wiki page allowed attackers to read arbitrary files on the server.

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6

CVE-2021-22200 7.5 - High - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6

CVE-2021-22200 7.5 - High - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access data of an internal repository through a public project fork as an anonymous user.

An issue has been discovered in GitLab CE/EE affecting all previous versions

CVE-2021-22202 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

Session Riding

An issue has been discovered in GitLab CE/EE affecting all previous versions

CVE-2021-22202 4.3 - Medium - April 02, 2021

An issue has been discovered in GitLab CE/EE affecting all previous versions. If the victim is an admin, it was possible to issue a CSRF in System hooks through the API.

Session Riding

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which

CVE-2021-22177 4.3 - Medium - April 01, 2021

Potential DoS was identified in gitlab-shell in GitLab CE/EE version 12.6.0 or above, which allows an attacker to spike the server resource utilization via gitlab-shell command.

Resource Exhaustion

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data

CVE-2021-22172 4.3 - Medium - March 26, 2021

Improper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releases page

AuthZ

An issue has been discovered in GitLab affecting all versions starting from 13.4

CVE-2021-22180 4.3 - Medium - March 26, 2021

An issue has been discovered in GitLab affecting all versions starting from 13.4. Improper access control allows unauthorized users to access details on analytic pages.

AuthZ

An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information

CVE-2021-22184 5.5 - Medium - March 26, 2021

An information disclosure issue in GitLab starting from version 12.8 allowed a user with access to the server logs to see sensitive information that wasn't properly redacted.

Information Disclosure

In all versions of GitLab

CVE-2021-22194 4.4 - Medium - March 26, 2021

In all versions of GitLab, marshalled session keys were being stored in Redis.

Cleartext Storage of Sensitive Information

An issue was identified in GitLab EE 13.4 or later which leaked internal IP address

CVE-2021-22169 4.3 - Medium - March 24, 2021

An issue was identified in GitLab EE 13.4 or later which leaked internal IP address via error messages.

Information Disclosure

An issue has been discovered in GitLab affecting all versions starting with 3.0.1

CVE-2021-22176 4.3 - Medium - March 24, 2021

An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests

AuthZ

An issue has been discovered in GitLab affecting all versions starting from 13.2

CVE-2021-22178 5 - Medium - March 24, 2021

An issue has been discovered in GitLab affecting all versions starting from 13.2. Gitlab was vulnerable to SRRF attack through the Prometheus integration.

XSPA

A vulnerability was discovered in GitLab versions before 12.2

CVE-2021-22179 5.4 - Medium - March 24, 2021

A vulnerability was discovered in GitLab versions before 12.2. GitLab was vulnerable to a SSRF attack through the Outbound Requests feature.

XSPA

Insufficient input sanitization in wikis in GitLab version 13.8 and up

CVE-2021-22185 5.4 - Medium - March 24, 2021

Insufficient input sanitization in wikis in GitLab version 13.8 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted commit to a wiki

XSS

An authorization issue in GitLab CE/EE version 9.4 and up

CVE-2021-22186 4.9 - Medium - March 24, 2021

An authorization issue in GitLab CE/EE version 9.4 and up allowed a group maintainer to modify group CI/CD variables which should be restricted to group owners

AuthZ

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2

CVE-2021-22192 8.8 - High - March 24, 2021

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.2 allowing unauthorized authenticated users to execute arbitrary code on the server.

An issue has been discovered in GitLab affecting all versions starting with 7.1

CVE-2021-22193 3.5 - Low - March 24, 2021

An issue has been discovered in GitLab affecting all versions starting with 7.1. A member of a private group was able to validate the use of a specific name for private project.

Generation of Error Message Containing Sensitive Information

An issue has been discovered in GitLab affecting all versions starting with 11.8

CVE-2021-22183 5.4 - Medium - March 04, 2021

An issue has been discovered in GitLab affecting all versions starting with 11.8. GitLab was vulnerable to a stored XSS in the epics page, which could be exploited with user interactions.

XSS

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP

CVE-2021-22189 7.2 - High - March 04, 2021

Starting with version 13.7 the Gitlab CE/EE editions were affected by a security issue related to the validation of the certificates for the Fortinet OTP that could result in authentication issues.

Improper Certificate Validation

An issue has been discovered in GitLab affecting all versions starting with 13.7

CVE-2021-22182 5.4 - Medium - March 03, 2021

An issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.

XSS

An issue has been discovered in GitLab affecting all versions starting with 13.0

CVE-2021-22188 5.3 - Medium - March 03, 2021

An issue has been discovered in GitLab affecting all versions starting with 13.0. Confidential issue titles in Gitlab were readable by an unauthorised user via branch logs.

An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7

CVE-2021-22187 4.3 - Medium - March 02, 2021

An issue has been discovered in GitLab affecting all versions of Gitlab EE/CE before 13.6.7. A potential resource exhaustion issue that allowed running or pending jobs to continue even after project was deleted.

Resource Exhaustion

An issue has been discovered in GitLab affecting all versions starting from 12.4

CVE-2020-26414 6.5 - Medium - January 15, 2021

An issue has been discovered in GitLab affecting all versions starting from 12.4. The regex used for package names is written in a way that makes execution time have quadratic growth based on the length of the malicious input string.

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

CVE-2021-22166 7.5 - High - January 15, 2021

An attacker could cause a Prometheus denial of service in GitLab 13.7+ by sending an HTTP request with a malformed method

Resource Exhaustion

An issue has been discovered in GitLab affecting all versions starting from 12.1

CVE-2021-22167 7.5 - High - January 15, 2021

An issue has been discovered in GitLab affecting all versions starting from 12.1. Incorrect headers in specific project page allows attacker to have a temporary read access to the private repository

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting

CVE-2021-22168 6.5 - Medium - January 15, 2021

A regular expression denial of service issue has been discovered in NuGet API affecting all versions of GitLab starting from version 12.8.

Resource Exhaustion

Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+

CVE-2021-22171 6.5 - Medium - January 15, 2021

Insufficient validation of authentication parameters in GitLab Pages for GitLab 11.5+ allows an attacker to steal a victim's API token if they click on a maliciously crafted link

authentification

A potential DOS vulnerability was discovered in all versions of Gitlab starting

CVE-2020-26411 4.3 - Medium - December 11, 2020

A potential DOS vulnerability was discovered in all versions of Gitlab starting from 13.4.x (>=13.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2). Using a specific query name for a project search can cause statement timeouts that can lead to a potential DOS if abused.

Improper Resource Shutdown or Release

An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2

CVE-2020-13357 4.3 - Medium - December 11, 2020

An issue was discovered in Gitlab CE/EE versions >= 13.1 to <13.4.7, >= 13.5 to <13.5.5, and >= 13.6 to <13.6.2 allowed an unauthorized user to access the user list corresponding to a feature flag in a project.

Insecure Direct Object Reference / IDOR

A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2

CVE-2020-26408 5.3 - Medium - December 11, 2020

A limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 that allows an attacker to view limited information in user's private profile

Information Disclosure

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.

CVE-2020-26412 4.3 - Medium - December 11, 2020

Removed group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 13.2 before 13.6.2.

Information Disclosure

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2

CVE-2020-26413 5.3 - Medium - December 11, 2020

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 13.6.2. Information disclosure via GraphQL results in user email being unexpectedly visible.

Information Disclosure

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API

CVE-2020-26415 4.3 - Medium - December 11, 2020

Information about the starred projects for private user profiles was exposed via the GraphQL API starting from 12.2 via the REST API. This affects GitLab >=12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

Information Disclosure

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs

CVE-2020-26416 4.4 - Medium - December 11, 2020

Information disclosure in Advanced Search component of GitLab EE starting from 8.4 results in exposure of search terms via Rails logs. This affects versions >=8.4 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2.

Information Disclosure

Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership

CVE-2020-26417 5.3 - Medium - December 11, 2020

Information disclosure via GraphQL in GitLab CE/EE 13.1 and later exposes private group and project membership. This affects versions >=13.6 to <13.6.2, >=13.5 to <13.5.5, and >=13.1 to <13.4.7.

Information Disclosure

A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2

CVE-2020-26409 6.5 - Medium - December 11, 2020

A DOS vulnerability exists in Gitlab CE/EE >=10.3, <13.4.7,>=13.5, <13.5.5,>=13.6, <13.6.2 that allows an attacker to trigger uncontrolled resource by bypassing input validation in markdown fields.

Improper Input Validation

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2

CVE-2020-26407 5.4 - Medium - December 10, 2020

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project

XSS

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14

CVE-2020-13355 8.1 - High - November 19, 2020

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.14. A path traversal is found in LFS Upload that allows attacker to overwrite certain specific paths on the server. Affected versions are: >=8.14, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Directory traversal

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9

CVE-2020-13356 8.2 - High - November 19, 2020

An issue has been discovered in GitLab CE/EE affecting all versions starting from 8.8.9. A specially crafted request could bypass Multipart protection and read files in certain specific paths on the server. Affected versions are: >=8.8.9, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation

CVE-2020-13359 7.6 - High - November 19, 2020

The Terraform API in GitLab CE/EE 12.10+ exposed the object storage signed URL on the delete operation allowing a malicious project maintainer to overwrite the Terraform state, bypassing audit and other business controls. Affected versions are >=12.10, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Information Disclosure

An issue has been discovered in GitLab EE affecting all versions starting from 10.2

CVE-2020-13348 5.7 - Medium - November 17, 2020

An issue has been discovered in GitLab EE affecting all versions starting from 10.2. Required CODEOWNERS approval could be bypassed by targeting a branch without the CODEOWNERS file. Affected versions are >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

An issue has been discovered in GitLab EE affecting all versions starting from 8.12

CVE-2020-13349 4.3 - Medium - November 17, 2020

An issue has been discovered in GitLab EE affecting all versions starting from 8.12. A regular expression related to a file path resulted in the Advanced Search feature susceptible to catastrophic backtracking. Affected versions are >=8.12, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8

CVE-2020-26405 7.1 - High - November 17, 2020

Path traversal vulnerability in package upload functionality in GitLab CE/EE starting from 12.8 allows an attacker to save packages in arbitrary locations. Affected versions are >=12.8, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

Directory traversal

CSRF in runner administration page in all versions of GitLab CE/EE

CVE-2020-13350 4.3 - Medium - November 17, 2020

CSRF in runner administration page in all versions of GitLab CE/EE allows an attacker who's able to target GitLab instance administrators to pause/resume runners. Affected versions are >=13.5.0, <13.5.2,>=13.4.0, <13.4.5,<13.3.9.

Session Riding

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+

CVE-2020-13351 6.5 - Medium - November 17, 2020

Insufficient permission checks in scheduled pipeline API in GitLab CE/EE 13.0+ allows an attacker to read variable names and values for scheduled pipelines on projects visible to the attacker. Affected versions are >=13.0, <13.3.9,>=13.4.0, <13.4.5,>=13.5.0, <13.5.2.

Incorrect Default Permissions

Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group

CVE-2020-13352 5.3 - Medium - November 17, 2020

Private group info is leaked leaked in GitLab CE/EE version 10.2 and above, when the project is moved from private to public group. Affected versions are: >=10.2, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6

CVE-2020-13354 4.3 - Medium - November 17, 2020

A potential DOS vulnerability was discovered in GitLab CE/EE starting with version 12.6. The container registry name check could cause exponential number of backtracks for certain user supplied values resulting in high CPU usage. Affected versions are: >=12.6, <13.3.9.

Resource Exhaustion

A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects

CVE-2020-13358 5.5 - Medium - November 17, 2020

A vulnerability in the internal Kubernetes agent api in GitLab CE/EE version 13.3 and above allows unauthorized access to private projects. Affected versions are: >=13.4, <13.4.5,>=13.3, <13.3.9,>=13.5, <13.5.2.

AuthZ

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3

CVE-2020-26406 5.3 - Medium - November 17, 2020

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE starting with 13.3. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects. Affected versions are: >=13.3, <13.3.9,>=13.4, <13.4.5,>=13.5, <13.5.2.

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2

CVE-2020-13341 4.9 - Medium - October 12, 2020

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Insufficient permission check allows attacker with developer role to perform various deletions.

Incorrect Permission Assignment for Critical Resource

An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview

CVE-2020-13339 6.5 - Medium - October 08, 2020

An issue has been discovered in GitLab affecting all versions before 13.2.10, 13.3.7 and 13.4.2: XSS in SVG File Preview. Overall impact is limited due to the current user only being impacted.

XSS

An issue has been discovered in GitLab affecting all versions prior to 13.2.10

CVE-2020-13340 8.7 - High - October 08, 2020

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

XSS

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2

CVE-2020-13344 4.4 - Medium - October 08, 2020

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2. Sessions keys are stored in plain-text in Redis which allows attacker with Redis access to authenticate as any user that has a session stored in Redis

Information Disclosure

An issue has been discovered in GitLab affecting versions prior to 13.2.10

CVE-2020-13342 2.7 - Low - October 07, 2020

An issue has been discovered in GitLab affecting versions prior to 13.2.10, 13.3.7 and 13.4.2: Lack of Rate Limiting at Re-Sending Confirmation Email

Resource Exhaustion

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks

CVE-2020-13334 7.5 - High - October 07, 2020

In GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, improper authorization checks allow a non-member of a project/group to change the confidentiality attribute of issue via mutation GraphQL query

AuthZ

Improper group membership validation when deleting a user account in GitLab >=7.12

CVE-2020-13335 4.3 - Medium - October 07, 2020

Improper group membership validation when deleting a user account in GitLab >=7.12 allows a user to delete own account without deleting/transferring their group.

authentification

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2

CVE-2020-13346 6.5 - Medium - October 07, 2020

Membership changes are not reflected in ToDo subscriptions in GitLab versions prior to 13.2.10, 13.3.7 and 13.4.2, allowing guest users to access confidential issues through API.

Information Disclosure

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1

CVE-2020-13347 9.1 - Critical - October 07, 2020

A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4, 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor, which allows the attacker to run arbitrary commands on Windows host, via DOCKER_AUTH_CONFIG build variable.

Command Injection

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3

CVE-2020-13333 4.3 - Medium - October 06, 2020

A potential DOS vulnerability was discovered in GitLab versions 13.1, 13.2 and 13.3. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.

Resource Exhaustion

Stay on top of Security Vulnerabilities

Want an email whenever new vulnerabilities are published for GitLab or by GitLab? Click the Watch button to subscribe.

GitLab
Vendor

GitLab
Version Control Server and CI/CD Platform

subscribe