Ashish

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.7 through 17.1.7 GitLab CE/EE versions 17.2 through 17.2.5 GitLab CE/EE versions 17.3 through 17.3.2 Description: An issue was discovered in GitLab CE/EE where group runners information was disclosed to unauthorized group members. The issue is related to the Group Member Handler component and involves bypassing authorization via a user-controlled key, allowing a remote attacker to gain unauthorized access to protected information. Recommendations: For GitLab CE/EE versions 16.7 through 17.1.7, update to version 17.1.7 or later. For GitLab CE/EE versions 17.2 through 17.2.5, update to version 17.2.5 or later. For GitLab CE/EE versions 17.3 through 17.3.2, update to version 17.3.2 or later. As a temporary workaround, consider restricting access to group runners information to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1 through 16.11.5 GitLab CE/EE versions 17.0 through 17.0.3 GitLab CE/EE versions 17.1 through 17.1.1 Description: The issue is related to inadequate access control in GitLab, a collaborative coding platform. It allows a non-project member to promote key results to objectives, potentially leading to unauthorized access to protected information. Recommendations: For versions 16.1 through 16.11.5, update to version 16.11.5 or later. For versions 17.0 through 17.0.3, update to version 17.0.3 or later. For versions 17.1 through 17.1.1, update to version 17.1.1 or later.

A privilege escalation issue was discovered in GitLab. It was possible for a user with a custom role of `manage group access tokens` to rotate group access tokens with owner privileges.

A privilege escalation issue in GitLab EE allows a project Maintainer to use a Project Access Token to escalate their role to Owner.

An issue has been discovered in GitLab where non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.

A blind SSRF vulnerability was identified which allows an attacker to connect to a local host.

An issue with access control in GitLab CE/EE allowed unauthorized users to view release names, even when releases were restricted to project members only.

An information disclosure issue in GitLab EE allows the disclosure of release titles if group milestones are associated with any project releases.

An information disclosure issue allowed non-project members to see the default branch name for projects that restrict access to the repository to project members.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.6 and later Description: The issue allows an attacker to see pending invitations of any public group or public project by visiting a specific "API endpoint". Recommendations: For GitLab CE/EE versions 13.6 and later, consider restricting access to the API endpoint until a patch is available.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.8 and above Description: An issue has been discovered allowing an authenticated user to delete incident metric images of public projects. Recommendations: For GitLab CE/EE versions 13.8 and above, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Certain SAST CiConfiguration information could be viewed by unauthorized users in GitLab EE. This information was exposed through GraphQL to non-members of public projects with repository visibility restricted as well as guest members on private projects.

A vulnerability was discovered that allows project reporters and above to see confidential EPIC attached to confidential issues.

An issue was discovered that could result in disclosure of private milestones, labels, and other information due to an IDOR in the epic notes API.