Exposición de GitLab
Development, Issue trackers318
score de exposición
658
sitios usan
4
en explotación
24
críticos
Análisis Vexday
Com 1.068 CVEs catalogadas e 78 novas vulnerabilidades registradas nos últimos 90 dias, o GitLab apresenta um volume de exposição que exige monitoramento contínuo. A taxa de exploração ativa — 4 entradas no catálogo KEV da CISA, representando 0,37% do total — está abaixo da média geral do catálogo (0,45%), embora esse dado não elimine a atenção necessária às falhas confirmadas. A vulnerabilidade CVE-2021-22205 concentra o maior risco imediato, com score EPSS de 0,9973, indicando altíssima probabilidade de exploração ativa, e deve ser tratada como prioridade absoluta em qualquer plano de remediação. O tipo de falha mais recorrente, CWE-770 (alocação de recursos sem limite ou controle), combinado com 24 vulnerabilidades de severidade crítica, sugere atenção estrutural às práticas de desenvolvimento e à gestão de recursos na plataforma.
CVEs
1087 resultadosCVE-2021-22172MEDIUMImproper authorization in GitLab 12.8+ allows a guest user in a private project to view tag data that should be inaccessible on the releasesEPSS 1.0%CVE-2022-3478MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.EPSS 1.0%CVE-2019-15578—An information disclosure exists in < 12.3.2, < 12.2.6, and < 12.1.12 for GitLab Community Edition (CE) and Enterprise Edition (EE). The patEPSS 1.0%CVE-2020-26408MEDIUMA limited information disclosure vulnerability exists in Gitlab CE/EE from >= 12.2 to <13.4.7, >=13.5 to <13.5.5, and >=13.6 to <13.6.2 thatEPSS 1.0%CVE-2022-1948HIGHAn issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick acEPSS 1.0%CVE-2020-13263HIGHAn authorization issue relating to project maintainer impersonation was identified in GitLab EE 9.5 and later through 13.0.1 that could alloEPSS 1.0%CVE-2020-13285HIGHFor GitLab before 13.0.12, 13.1.6, 13.2.3 a cross-site scripting (XSS) vulnerability exists in the issue reference number tooltip.EPSS 1.0%CVE-2022-1120MEDIUMMissing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2EPSS 1.0%CVE-2020-13324MEDIUMA vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed viEPSS 1.0%CVE-2020-13307LOWA vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. GitLab was not revoking current user sessions when 2 faEPSS 1.0%CVE-2023-0756MEDIUMAn issue has been discovered in GitLab affecting all versions before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions sEPSS 1.0%CVE-2021-22264MEDIUMAn issue has been discovered in GitLab affecting all versions starting from 13.8 before 14.0.9, all versions starting from 14.1 before 14.1.EPSS 1.0%CVE-2021-22244LOWImproper authorization in the vulnerability report feature in GitLab EE affecting all versions since 13.1 allowed a reporter to access vulneEPSS 1.0%CVE-2021-22182LOWAn issue has been discovered in GitLab affecting all versions starting with 13.7. GitLab was vulnerable to a stored XSS in merge request.EPSS 1.0%CVE-2022-3572CRITICALA cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, andEPSS 1.0%CVE-2021-22200MEDIUMAn issue has been discovered in GitLab CE/EE affecting all versions starting with 12.6. Under a special condition it was possible to access EPSS 1.0%CVE-2021-39891MEDIUMIn all versions of GitLab CE/EE since version 8.0, access tokens created as part of admin's impersonation of a user are not cleared at the eEPSS 1.0%CVE-2020-26412LOWRemoved group members were able to use the To-Do functionality to retrieve updated information on confidential epics starting in GitLab EE 1EPSS 1.0%CVE-2021-22258MEDIUMThe project import/export feature in GitLab 8.9 and greater could be used to obtain otherwise private email addressesEPSS 1.0%CVE-2021-39884MEDIUMIn all versions of GitLab EE since version 8.13, an endpoint discloses names of private groups that have access to a project to low privilegEPSS 1.0%