CVSS: 7.3EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4331
https://notcve.org/view.php?id=CVE-2022-4331
An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4331.json https://gitlab.com/gitlab-org/gitlab/-/issues/385050 https://hackerone.com/reports/1791518 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-1072
https://notcve.org/view.php?id=CVE-2023-1072
An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1072.json https://gitlab.com/gitlab-org/gitlab/-/issues/219619 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0483
https://notcve.org/view.php?id=CVE-2023-0483
An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible for a project maintainer to extract a Datadog integration API key by modifying the site. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0483.json https://gitlab.com/gitlab-org/gitlab/-/issues/389188 https://hackerone.com/reports/1836466 •
CVSS: 5.3EPSS: 0%CPEs: 6EXPL: 0CVE-2023-0223
https://notcve.org/view.php?id=CVE-2023-0223
An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings. • https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0223.json https://gitlab.com/gitlab-org/gitlab/-/issues/387870 https://hackerone.com/reports/1824226 •
CVSS: 6.4EPSS: 0%CPEs: 6EXPL: 0CVE-2022-4289
https://notcve.org/view.php?id=CVE-2022-4289
An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users. • https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4289.json https://gitlab.com/gitlab-org/gitlab/-/issues/384580 https://hackerone.com/reports/1780770 https://security.netapp.com/advisory/ntap-20240415-0004 •