Name of the Vulnerable Software and Affected Versions:

GitLab CE/EE versions 16.11 through 18.1.5

GitLab CE/EE versions 18.2 through 18.2.5

GitLab CE/EE versions 18.3 through 18.3.1

Description:

An issue exists in GitLab CE/EE that allows authenticated users to manipulate internal requests through proxy environments by injecting crafted sequences. This can lead to Server-Side Request Forgery (SSRF) via webhook headers.

Recommendations:

GitLab CE/EE versions 16.11 through 18.1.5: Update to version 18.1.6 or later.

GitLab CE/EE versions 18.2 through 18.2.5: Update to version 18.2.6 or later.

GitLab CE/EE versions 18.3 through 18.3.1: Update to version 18.3.2 or later.