CVSS: 4.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-13041 – Incorrect User Management in GitLab
https://notcve.org/view.php?id=CVE-2024-13041
09 Jan 2025 — An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups. • https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configuration • CWE-286: Incorrect User Management •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-6324 – Inefficient Algorithmic Complexity in GitLab
https://notcve.org/view.php?id=CVE-2024-6324
09 Jan 2025 — An issue was discovered in GitLab CE/EE affecting all versions starting from 15.7 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. It was possible to trigger a DoS by creating cyclic references between epics. • https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#cyclic-reference-of-epics-leads-resource-exhaustion • CWE-407: Inefficient Algorithmic Complexity •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-12431 – Missing Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-12431
08 Jan 2025 — An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects. • https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauthorized-user-can-manipulate-status-of-issues-in-public-projects • CWE-862: Missing Authorization •
CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 0CVE-2025-0194 – Insertion of Sensitive Information into Externally-Accessible File or Directory in GitLab
https://notcve.org/view.php?id=CVE-2025-0194
08 Jan 2025 — An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.1, starting from 17.6 prior to 17.6.1, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have been logged when API requests were made in a specific manner. An issue was discovered in GitLab CE/EE affecting all versions starting from 17.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. Under certain conditions, access tokens may have be... • https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#possible-access-token-exposure-in-gitlab-logs • CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory •