Albatraoz

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 15.2 through 15.9.5 GitLab EE versions 15.10 through 15.10.4 GitLab EE versions 15.11 through 15.11.0 **Description** An issue has been discovered in GitLab EE where a malicious group member may continue to have access to the public projects of a public group even after being banned from the public group by the owner. **Recommendations** For versions 15.2 through 15.9.5, update to version 15.9.6 or later. For versions 15.10 through 15.10.4, update to version 15.10.5 or later. For versions 15.11 through 15.11.0, update to version 15.11.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions prior to 15.0.5 GitLab CE/EE versions 15.1 prior to 15.1.4 GitLab CE/EE versions 15.2 prior to 15.2.1 **Description** An issue has been discovered that may allow group members to bypass 2FA enforcement enabled at the group level. This can be achieved by using the Resource Owner Password Credentials grant to obtain an access token without using 2FA. **Recommendations** For versions prior to 15.0.5, update to version 15.0.5 or later. For versions 15.1 prior to 15.1.4, update to version 15.1.4 or later. For versions 15.2 prior to 15.2.1, update to version 15.2.1 or later. As a temporary workaround, consider restricting the use of the Resource Owner Password Credentials grant until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 13.4 through 14.10.5 GitLab CE/EE versions 15.0 through 15.0.4 GitLab CE/EE versions 15.1 through 15.1.1 **Description** An issue has been discovered in GitLab CE/EE where the HTML source reveals if a user has enabled two-factor authentication on their account to unauthenticated users. **Recommendations** For versions 13.4 through 14.10.5, update to version 14.10.5 or later. For versions 15.0 through 15.0.4, update to version 15.0.4 or later. For versions 15.1 through 15.1.1, update to version 15.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 10.7 through 14.7.7 GitLab CE/EE versions 10.8 through 14.8.5 GitLab CE/EE versions 10.9 through 14.9.2 **Description** Improper access control in GitLab CE/EE allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances. **Recommendations** For versions 10.7 through 14.7.7, update to version 14.7.7 or later. For versions 10.8 through 14.8.5, update to version 14.8.5 or later. For versions 10.9 through 14.9.2, update to version 14.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 12.4 through 14.7.1 **Description** The issue is related to improper access control, allowing project non-members to retrieve the service desk email address. **Recommendations** For GitLab CE/EE versions 12.4 through 14.7.1, update to a version outside of the affected range to resolve the issue.