Multiple GitLab Products Vulnerabilities

Severity

Medium

Analysis Summary

CVE-2023-6477 CVSS:6.7

GitLab EE could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper privilege management. By sending a specially crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges.

CVE-2023-3509 CVSS:6.1

GitLab could allow a remote authenticated attacker to bypass security restrictions, caused by improper access control. By sending a specially crafted request, an attacker could exploit this vulnerability to change the title of privately accessible deploy keys associated with projects in the group.

CVE-2024-1525 CVSS:5.3

GitLab Community and Enterprise Edition could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw in the password reset feature. By sending a specially crafted request using verified secondary email address, an attacker could exploit this vulnerability to reset the password and sign-in using direct authentication.

CVE-2024-0410 CVSS:7.7

GitLab could allow a remote authenticated attacker to bypass security restrictions, caused by improper access control. By sending a specially crafted request using a merge conflict, an attacker could exploit this vulnerability to bypass CODEOWNERS approvals.

CVE-2023-4895 CVSS:4.3

GitLab Enterprise Edition could allow a remote authenticated attacker to obtain sensitive information, caused by a group ip restriction settings bypass flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain environment details information of projects, and use this information to launch further attacks against the affected system.

CVE-2024-0861 CVSS:4.3

GitLab Enterprise Edition could allow a remote authenticated attacker to bypass security restrictions, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to change Custom dashboard projects settings.

Impact