SB2021090204 - Multiple vulnerabilities in GitLab Community Edition (CE) and Enterprise Edition (EE)
Published: September 2, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 9 secuirty vulnerabilities.
1) Stored cross-site scripting (CVE-ID: N/A)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in DataDog Integration. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Input validation error (CVE-ID: N/A)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to invited group members continue to have project access even after invited group is deleted. A remote authenticated attacker can continue to have access to a project even after the invited group.
3) Input validation error (CVE-ID: N/A)
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input in the apollo_upload_server Ruby gem. A remote authenticated attacker can send a specially crafted request and perform a denial of service (DoS) attack.
4) Permissions, Privileges, and Access Controls (CVE-ID: N/A)
The vulnerability allows a remote administrator to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions within project token, which leads to security restrictions bypass and privilege escalation.
5) Improper access control (CVE-ID: N/A)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote authenticated attacker can add and remove Jira Connect Namespaces via the GitLab.com for Jira Cloud application configuration page.
6) Information disclosure (CVE-ID: CVE-2021-22257)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the route for /user.keys is not restricted on instances with public visibility disabled. A remote attacker can gain unauthorized access to sensitive information on the system.
7) Information disclosure (CVE-ID: CVE-2021-22258)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the project import/export feature. A remote authenticated attacker can gain unauthorized access to sensitive information on the system.
8) Stored cross-site scripting (CVE-ID: CVE-2021-22238)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in markdown. A remote authenticated attacker can permanently inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
9) Stored cross-site scripting (CVE-ID: N/A)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Jira integration. A remote authenticated attacker can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
Remediation
Install update from vendor's website.