GitLab has remediated an issue in GitLab EE affecting all versions from 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to gain CSRF tokens by exploiting improper input validation in repository references combined with redirect handling weaknesses.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:NGitLab
APPGitlab18.4.0 – 18.4.4 (bez)18.5.0 – 18.5.2 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
CI/CDPath Traversal
Related vulnerabilities
CVE-2023-7028CRITICAL10.0⚠ KEVPL ✓ten sam produkt
GitLab: Przejęcie konta przez reset hasła na niezweryfikowany e-mail
CVE-2021-22205CRITICAL10.0⚠ KEVten sam produkt
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properl...
CVE-2024-7102CRITICAL9.6PL ✓ten sam produkt
GitLab CE/EE: uruchomienie pipeline jako inny użytkownik (privilege escalation)
CVE-2024-9164CRITICAL9.6PL ✓ten sam produkt
GitLab EE: uruchamianie pipeline CI/CD na dowolnych gałęziach bez autoryzacji
CVE-2024-6678CRITICAL9.9PL ✓ten sam produkt
GitLab CE/EE — uruchomienie pipeline jako dowolny użytkownik (CWE-290)