Vaib25Vicky

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 13.12 through 16.0.7 GitLab EE versions 16.1 through 16.1.2 GitLab EE versions 16.2 through 16.2.1 **Description** An issue has been discovered in GitLab EE, affecting the authorization procedure. This issue allows an attacker to run pipeline jobs as an arbitrary user via scheduled security scan policies. The exploitation of this issue may enable a remote attacker to launch tasks in the name of any user. **Recommendations** For versions 13.12 through 16.0.7, update to version 16.0.8 or later. For versions 16.1 through 16.1.2, update to version 16.1.3 or later. For versions 16.2 through 16.2.1, update to version 16.2.2 or later. As a temporary workaround, consider restricting access to scheduled security scan policies until a patch is available.

**Name of the Vulnerable Software and Affected Versions** GitLab versions 12.8 through 15.7.8 GitLab versions 15.8 through 15.8.4 GitLab versions 15.9 through 15.9.2 **Description** The issue could allow a user to unmask the Discord Webhook URL through viewing the raw API response. **Recommendations** For versions 12.8 through 15.7.8, update to version 15.7.8 or later. For versions 15.8 through 15.8.4, update to version 15.8.4 or later. For versions 15.9 through 15.9.2, update to version 15.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 15.1 through 15.7.7 GitLab EE versions 15.8 through 15.8.3 GitLab EE versions 15.9 through 15.9.1 **Description** An issue has been discovered in GitLab EE. If a group with SAML SSO enabled is transferred to a new namespace as a child group, it's possible that a previously removed malicious maintainer or owner of the child group can still gain access to the group via SSO or a SCIM token to perform actions on the group. **Recommendations** For GitLab EE versions 15.1 through 15.7.7, update to version 15.7.8 or later. For GitLab EE versions 15.8 through 15.8.3, update to version 15.8.4 or later. For GitLab EE versions 15.9 through 15.9.1, update to version 15.9.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions prior to 15.0.5 GitLab CE/EE versions 15.1 prior to 15.1.4 GitLab CE/EE versions 15.2 prior to 15.2.1 **Description** An issue has been discovered that may allow access to a private project through an email invite by using another user's email address as an unverified secondary email. **Recommendations** For versions prior to 15.0.5, update to version 15.0.5 or later. For versions 15.1 prior to 15.1.4, update to version 15.1.4 or later. For versions 15.2 prior to 15.2.1, update to version 15.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions prior to 15.0.5 GitLab EE versions 15.1 prior to 15.1.4 GitLab EE versions 15.2 prior to 15.2.1 **Description** The issue is related to pipeline subscriptions in GitLab EE, where new pipelines are triggered with the person who created the tag as the pipeline creator instead of the subscription's author. **Recommendations** For versions prior to 15.0.5, update to version 15.0.5 or later. For versions 15.1 prior to 15.1.4, update to version 15.1.4 or later. For versions 15.2 prior to 15.2.1, update to version 15.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions prior to 14.10.5 GitLab CE/EE version 15.0 prior to 15.0.4 GitLab CE/EE version 15.1 prior to 15.1.1 **Description** The issue is related to improper access control in the runner jobs API, allowing a previous maintainer of a project with a specific runner to access job and project meta data under certain conditions. **Recommendations** For versions prior to 14.10.5, update to version 14.10.5 or later. For version 15.0 prior to 15.0.4, update to version 15.0.4 or later. For version 15.1 prior to 15.1.1, update to version 15.1.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab CE/EE versions 10.7 through 14.3.5 GitLab CE/EE versions 14.4 through 14.4.3 GitLab CE/EE versions 14.5 through 14.5.1 **Description** The issue is related to improper access control in GitLab CE/EE, allowing an attacker with a deploy token to access a project's disabled wiki. **Recommendations** For versions 10.7 through 14.3.5, update to version 14.3.6 or later. For versions 14.4 through 14.4.3, update to version 14.4.4 or later. For versions 14.5 through 14.5.1, update to version 14.5.2 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 11.3 through 14.2.6 GitLab EE versions 14.3 through 14.3.4 GitLab EE versions 14.4 through 14.4.1 **Description** The issue is related to a lack of email address ownership verification in the CODEOWNERS feature. This allows an attacker to bypass the CODEOWNERS Merge Request approval requirement under rare circumstances. **Recommendations** For versions 11.3 through 14.2.6, update to version 14.2.6 or later. For versions 14.3 through 14.3.4, update to version 14.3.4 or later. For versions 14.4 through 14.4.1, update to version 14.4.1 or later.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 13.1 and later **Description** The issue is related to improper authorization in the vulnerability report feature, allowing a reporter to access vulnerability data. This could potentially lead to unauthorized access to confidential data. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited. **Recommendations** For GitLab EE versions 13.1 and later, update to a version that includes a fix for the improper authorization issue in the vulnerability report feature. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GitLab EE versions 13.4 and later **Description** The issue is related to improper authorization, allowing a user who previously had necessary access to trigger deployments to protected environments under specific conditions, even after their access has been removed. This can lead to data integrity issues and potentially cause a denial of service. **Recommendations** For GitLab EE versions 13.4 and later, update to a version that includes the fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to protected environments to minimize the risk of unauthorized deployments.

**Name of the Vulnerable Software and Affected Versions** GitLab versions prior to 12.10.13 **Description** An issue has been discovered that allowed a project member with limited permissions to view the project security dashboard. **Recommendations** For versions prior to 12.10.13, update to version 12.10.13 or later to resolve the issue.