Nick Malcolm

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 9.3 through 15.2.4 GitLab EE versions 15.3 through 15.3.3 GitLab EE versions 15.4 through 15.4.0 **Description** Email addresses were leaked in WebHook logs. The issue affects GitLab EE, with the leak occurring in the logs. **Recommendations** For GitLab EE versions 9.3 through 15.2.4, update to version 15.2.5 or later. For GitLab EE versions 15.3 through 15.3.3, update to version 15.3.4 or later. For GitLab EE versions 15.4 through 15.4.0, update to version 15.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab Enterprise Edition versions 11.10 through 14.9.5 GitLab Enterprise Edition versions 14.10 through 14.10.4 GitLab Enterprise Edition versions 15.0 through 15.0.1 **Description** The issue is related to the SCIM feature in GitLab, which can allow an attacker to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker-controlled email address, thus taking over those accounts in the absence of 2FA. The attacker can also change the display name and username of the targeted account. This issue affects GitLab Enterprise Edition when group SAML SSO is configured. **Recommendations** For GitLab Enterprise Edition versions 11.10 through 14.9.5, update to version 14.9.5 or later. For GitLab Enterprise Edition versions 14.10 through 14.10.4, update to version 14.10.4 or later. For GitLab Enterprise Edition versions 15.0 through 15.0.1, update to version 15.0.1 or later. As a temporary workaround, consider disabling the SCIM feature until a patch is available. Restrict access to the SCIM feature to minimize the risk of exploitation. Enable 2FA to prevent account takeover.

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.0 and later Description: The issue allows an attacker to bypass the setting to disable Bitbucket Server import by making a crafted API call. This affects instances of GitLab CE/EE where this setting is enabled. Recommendations: For GitLab CE/EE versions 13.0 and later, consider restricting access to the API endpoint used for Bitbucket Server import until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.