GitLab, a major DevOps platform, has recently patched a series of critical vulnerabilities that threaten the integrity of software development pipelines across its Community and Enterprise editions. These security flaws, if exploited, could allow unauthorized account access and control over critical software deployment processes.
Overview of the Vulnerabilities
Three key vulnerabilities have been identified:
- CVE-2023-7028: This vulnerability allows attackers to send password reset emails to unverified addresses, potentially leading to account takeovers.
- CVE-2023-5356: Exploitation of this flaw could enable attackers to execute commands in Slack or Mattermost as another user.
- CVE-2023-4812: It permits users to bypass required approvals in code changes by manipulating merge requests.
Affected Versions
The vulnerabilities impact several versions of GitLab CE (Community Edition) and EE (Enterprise Edition):
- Versions 16.1 to 16.7 (before specific patch versions) are affected by CVE-2023-7028.
- The issues span from versions 8.13 to 16.7 for CVE-2023-5356.
- CVE-2023-4812 affects versions from 15.3 up to the latest before the patched releases.
Severity and Impact
These vulnerabilities are rated up to 10 on the CVSS scale, indicating their critical nature. They pose significant risks including data breaches, unauthorized changes to code, and potential disruptions to business operations.
Recommendations
GitLab strongly advises users to upgrade to the latest versions that have patched these vulnerabilities. Enabling Two-Factor Authentication (2FA) is also recommended to add an extra layer of security.
Organizations using GitLab must take immediate action to apply these updates to protect their software pipelines from potential threats. Regularly reviewing and updating software solutions with the latest security patches is crucial in maintaining the integrity and security of IT infrastructure​
