An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to privilege escalation for those users.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4ffcccae-e924-11ed-9c88-001b217b3468 advisory.

  - An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from     15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Under certain conditions, an     attacker may be able to map a private email of a GitLab user to their GitLab account on an instance.
    (CVE-2022-4376)

  - An issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from     15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The main branch of a repository     with a specially crafted name allows an attacker to create repositories with malicious code, victims who     clone or download these repositories will execute arbitrary code on their systems. (CVE-2023-0756)

  - An issue has been discovered in GitLab EE affecting all versions starting from 15.2 before 15.9.6, all     versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious     group member may continue to have access to the public projects of a public group even after being banned     from the public group by the owner. (CVE-2023-0805)

  - An issue has been discovered in GitLab CE/EE affecting all versions from 8.6 before 15.9.6, all versions     starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. File integrity may be     compromised when source code or installation packages are pulled from a tag or from a release containing a     ref to another commit. (CVE-2023-1178)

  - An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all     versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects     even from a restricted IP address. (CVE-2023-1621)

  - A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before     15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1.
    When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed on an     iOS device. (CVE-2023-1836)

  - An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all     versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of     verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for     3rd party Group SAML SSO logins. This feature isn't enabled by default. (CVE-2023-1965)

  - An issue has been discovered in GitLab affecting all versions starting from 10.0 before 12.9.8, all     versions starting from 12.10 before 12.10.7, all versions starting from 13.0 before 13.0.1. A user with     the role of developer could use the import project feature to leak CI/CD variables. (CVE-2023-2069)

  - An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all     versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an     instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to     privilege escalation for those users. (CVE-2023-2182)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - An issue has been discovered in GitLab EE affecting all versions starting from 15.10 before 15.10.5, all     versions starting from 15.11 before 15.11.1. Under certain conditions when OpenID Connect is enabled on an     instance, it may allow users who are marked as 'external' to become 'regular' users thus leading to     privilege escalation for those users. (CVE-2023-2182)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
175004	FreeBSD : Gitlab -- Multiple Vulnerabilities (4ffcccae-e924-11ed-9c88-001b217b3468)	Nessus	FreeBSD Local Security Checks	high
174996	GitLab 15.10 < 15.10.5 / 15.11 < 15.11.1 (CVE-2023-2182)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2023-2182

high

Tenable Plugins

high

high