Executive Summary

This vulnerability in GitLab EE allows an authenticated attacker to execute unauthorized quick actions by including malicious commands in specific descriptions. It affects certain versions before they were patched.

Useful 0 Not Useful 0

Impact Analysis

An attacker who is authenticated could perform unauthorized quick actions, potentially leading to unintended changes or actions within the GitLab environment, which could disrupt workflows or compromise data integrity.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update GitLab EE to a fixed version: 18.3.5 or later if you are on the 17.6.0 to before 18.3.5 range, 18.4.3 or later if you are on 18.4 before 18.4.3, or 18.5.1 or later if you are on 18.5 before 18.5.1. This will prevent authenticated attackers from executing unauthorized quick actions via malicious commands in descriptions.

Useful 0 Not Useful 0