CERT-In Vulnerability Note
CIVN-2022-0255
Multiple Vulnerabilities in GitLab
Original Issue Date:June 03, 2022
Severity Rating: CRITICAL
Software Affected
- GitLab versions prior to 15.0.1, 14.10.4, 14.9.5 for GitLab Community Edition (CE) and Enterprise Edition (EE)
Overview
Multiple vulnerabilities have been reported in GitLab, which could be exploited by an attacker to account takeover, sensitive information disclosure, improper authentication, security restriction bypass, and execute arbitrary code on the targeted system.
Description
These vulnerabilities exist in GitLab due to account take over via SCIM email change, stored XSS in Jira integration, quick action commands susceptible to XSS, IP allow list bypass when using Trigger tokens, Project Deploy Tokens, improper authorization in the Interactive Web Terminal, subgroup member can list members of parent group, and group member lock bypass.
Successful exploitation of these vulnerabilities could allow an attacker to account takeover, sensitive information disclosure, improper authentication, security restriction bypass and execute arbitrary code on the targeted system.
Solution
Apply appropriate updates as mentioned in GitLab Security Release
https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
Vendor Information
GitLab
https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
References
GitLab
https://about.gitlab.com/releases/2022/06/01/critical-security-release-gitlab-15-0-1-released/
CVE Name
CVE-2022-1783
CVE-2022-1821
CVE-2022-1948
CVE-2022-1680
CVE-2022-1935
CVE-2022-1936
CVE-2022-1940
CVE-2022-1944
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|