Ali_Shehab

**Name of the Vulnerable Software and Affected Versions** GitLab versions 11.3 through 16.7.6 GitLab versions 16.7.6 through 16.8.3 GitLab versions 16.8.3 through 16.9.1 **Description** An authorization bypass vulnerability was discovered in GitLab, allowing an attacker to bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions. This issue potentially exposes financial data or code. Approximately 509,862 devices are potentially affected, mainly distributed in China and the United States. **Recommendations** For GitLab versions 11.3 through 16.7.6, upgrade to version 16.7.7 to patch the vulnerability. For GitLab versions 16.7.6 through 16.8.3, upgrade to version 16.8.4 to patch the vulnerability. For GitLab versions 16.8.3 through 16.9.1, upgrade to version 16.9.2 to patch the vulnerability. As a temporary workaround, consider restricting access to old feature branches to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 15.1 through 16.7.5 GitLab versions 16.8 through 16.8.2 GitLab versions 16.9 through 16.9.0 **Description** The issue is related to insufficient access control in GitLab, allowing a remote attacker to bypass security restrictions. A developer can bypass CODEOWNERS approvals by creating a merge conflict. **Recommendations** For GitLab versions 15.1 through 16.7.5, update to version 16.7.6 or later. For GitLab versions 16.8 through 16.8.2, update to version 16.8.3 or later. For GitLab versions 16.9 through 16.9.0, update to version 16.9.1 or later. As a temporary workaround, consider restricting the ability to create merge conflicts until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 9.3 through 16.4.3 GitLab versions 16.5 through 16.5.3 GitLab versions 16.6 through 16.6.1 **Description** An issue has been discovered in GitLab where, in certain situations, it may have been possible for developers to override predefined CI variables via the REST API. **Recommendations** For GitLab versions 9.3 through 16.4.3, update to version 16.4.4 or later. For GitLab versions 16.5 through 16.5.3, update to version 16.5.4 or later. For GitLab versions 16.6 through 16.6.1, update to version 16.6.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 15.3 through 16.5.6 GitLab EE versions 16.6 through 16.6.4 GitLab EE versions 16.7 through 16.7.2 **Description** The issue is related to insufficient access control to the CODEOWNERS file in GitLab EE, allowing a remote attacker to bypass required approvals by adding changes to a previously approved merge request. This could potentially lead to unauthorized access, modification, or deletion of data. **Recommendations** For versions 15.3 through 16.5.6, update to version 16.5.6 or later to resolve the issue. For versions 16.6 through 16.6.4, update to version 16.6.4 or later to resolve the issue. For versions 16.7 through 16.7.2, update to version 16.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the CODEOWNERS file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 12.0 through 15.10.8 GitLab EE versions 15.11 through 15.11.7 GitLab EE versions 16.0 through 16.0.2 **Description** An issue has been discovered in GitLab EE that allows an attacker to clone a repository from a public project, from a disallowed IP, even after the top-level group has enabled IP restrictions on the group. **Recommendations** For versions 12.0 through 15.10.8, update to a version after 15.10.8 to resolve the issue. For versions 15.11 through 15.11.7, update to a version after 15.11.7 to resolve the issue. For versions 16.0 through 16.0.2, update to a version after 16.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the repository cloning functionality until a patch is available.