发布于3月6日3月6日 Members FreeBSD: VID-54006796-CF7B-11ED-A5D5-001B217B3468 (CVE-2023-0523): Gitlab -- Multiple Vulnerabilities Severity 6 CVSS (AV:N/AC:M/Au:N/C:P/I:P/A:N) Published 03/30/2023 Created 04/04/2023 Added 04/01/2023 Modified 01/28/2025 Description Details for this vulnerability have not been published by NIST at this point. Descriptions from software vendor advisories for this issue are provided below. From VID-54006796-CF7B-11ED-A5D5-001B217B3468: Gitlab reports: Cross-site scripting in "Maximum page reached" page Private project guests can read new changes using a fork Mirror repository error reveals password in Settings UI DOS and high resource consumption of Prometheus server through abuse of Prometheus integration proxy endpoint Unauthenticated users can view Environment names from public projects limited to project members only Copying information to the clipboard could lead to the execution of unexpected commands Maintainer can leak masked webhook secrets by adding a new parameter to the webhook URL Arbitrary HTML injection possible when :soft_email_confirmation feature flag is enabled in the latest release Framing of arbitrary content (leading to open redirects) on any page allowing user controlled markdown MR for security reports are available to everyone API timeout when searching for group issues Unauthorised user can add child epics linked to victim's epic in an unrelated group GitLab search allows to leak internal notes Ambiguous branch name exploitation in GitLab Improper permissions checks for moving an issue Private project branches names can be leaked through a fork Solution(s) freebsd-upgrade-package-gitlab-ce References CVE-2023-0523
