Nyangawa

The issue is related to a stored XSS in the import Bitbucket project feature.

The issue allows Directory Traversal, which leads to arbitrary file read. A particular endpoint was vulnerable to a directory traversal vulnerability.

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 8.4 through 11.11 Description: An issue allows a malicious user to execute JavaScript code on notes by importing a specially crafted project file, enabling cross-site scripting (XSS). Recommendations: For GitLab Community and Enterprise Edition versions 8.4 through 11.11, update to a version that contains a fix for this issue to prevent malicious users from executing JavaScript code on notes.

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition version 11.11 Description: An issue allows an authenticated malicious user to execute commands remotely through the repository download feature, enabling Command Injection. This is possible with a specially crafted payload. Recommendations: For GitLab Community and Enterprise Edition version 11.11, update to a version that includes a fix for this issue to prevent command injection attacks. As a temporary workaround, consider restricting access to the repository download feature to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 8.4 through 11.11 Description: The protected branches feature in GitLab contained an access control issue, resulting in a bypass of the protected branches restriction rules. This issue is related to incorrect access control. Recommendations: For GitLab Community and Enterprise Edition versions 8.4 through 11.11, consider restricting access to the protected branches feature until a fix is available. As a temporary workaround, review and enforce manual access controls to minimize the risk of unauthorized branch modifications. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 10.2 through 11.11 Description: An issue was discovered in multiple features, causing Server-Side Request Forgery (SSRF) vulnerabilities due to insufficient validation to prevent DNS rebinding attacks. Recommendations: For GitLab Community and Enterprise Edition versions 10.2 through 11.11, update to a version that includes the fix for the SSRF vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows Directory Traversal. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

An issue was discovered that allows someone to obtain issues from private projects using the project import feature.

The issue is related to insufficient parameter sanitization for the Maven package registry, which could lead to privilege escalation and remote code execution under certain conditions.

The issue allows Directory Traversal. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue is related to a Server-Side Request Forgery (SSRF) vulnerability in webhooks. This means an attacker could potentially forge requests to internal services, leading to unauthorized access or actions.

Name of the Vulnerable Software and Affected Versions: GitLab Community and Enterprise Edition versions 11.0.0 through 11.3.12 GitLab Community and Enterprise Edition versions 11.4.0 through 11.4.10 GitLab Community and Enterprise Edition versions 11.5.0 through 11.5.3 Description: The issue is related to Incorrect Access Control. Recommendations: For GitLab Community and Enterprise Edition versions 11.0.0 through 11.3.12, update to version 11.3.13 or later. For GitLab Community and Enterprise Edition versions 11.4.0 through 11.4.10, update to version 11.4.11 or later. For GitLab Community and Enterprise Edition versions 11.5.0 through 11.5.3, update to version 11.5.4 or later.

The issue allows Directory Traversal in Templates API.