Rapid7 Vulnerability & Exploit Database

FreeBSD: VID-1020D401-6D2D-11EB-AB0B-001B217B3468: Gitlab -- Multiple Vulnerabilities

Back to Search

FreeBSD: VID-1020D401-6D2D-11EB-AB0B-001B217B3468: Gitlab -- Multiple Vulnerabilities

Severity
4
CVSS
(AV:L/AC:M/Au:N/C:P/I:P/A:P)
Published
02/11/2021
Created
02/17/2021
Added
02/13/2021
Modified
02/13/2021

Description

Gitlab reports:

Improper Certificate Validation for Fortinet OTP

Denial of Service Attack on gitlab-shell

Resource exhaustion due to pending jobs

Confidential issue titles were exposed

Improper access control allowed demoted project members to access authored merge requests

Improper access control allowed unauthorized users to access analytic pages

Unauthenticated CI lint API may lead to information disclosure and SSRF

Prometheus integration in Gitlab may lead to SSRF

Solution(s)

  • freebsd-upgrade-package-gitlab-ce

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;