CVE Vulnerability Advisory Database

[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)

[Impact] Unauthenticated attackers can execute arbitrary code on the GitLab server via crafted CI/CD configurations, leading to full system compromise

[Mitigation] Immediate upgrade to patched versions 19.2.8, 19.3.5, or 19.4.2 is mandatory

[Affected Scope] GitLab CE/EE versions from 18.7 through 19.3.1.

[Impact] Unauthenticated remote attackers can read arbitrary files from the server, potentially leading to full system compromise and credential theft.

[Mitigation] Immediate upgrade to patched versions: 18.11.12, 19.0.9, 19.1.8, 19.2.6, or 19.3.2.

[Affected Scope] GitLab CE/EE versions 16.1 to 16.7.1 (prior to 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, and 16.7.2)

[Impact] An unauthenticated remote attacker can trigger password reset emails to be sent to an arbitrary, unverified email address, leading to complete account takeover.

[Mitigation] Immediately upgrade GitLab instances to the patched versions (16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, 16.7.2 or later) and enforce Multi-Factor Authentication (MFA).

[Affected Scope] GitLab CE/EE versions 10.5 before 14.3.6, 14.4 before 14.4.4, and 14.5 before 14.5.2

[Impact] Unauthorized external attackers can perform Server-Side Request Forgery (SSRF) via the CI Lint API to access internal network resources and extract sensitive data

[Mitigation] Immediately upgrade GitLab instances to patched versions (14.3.6, 14.4.4, 14.5.2 or later) and restrict external access to the CI Lint API

[Affected Scope] All GitLab versions starting from 10.5 where internal network requests for webhooks are enabled

[Impact] Unauthenticated attackers can bypass registration restrictions to trigger SSRF, accessing sensitive internal network resources and metadata

[Mitigation] Upgrade to the latest patched GitLab version immediately, or disable the 'Allow requests to the local network from web hooks and services' setting