Executive Summary

This vulnerability in GitLab CE/EE versions from 16.9.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 allows an authenticated user to invoke unintended server-side methods through websocket connections. This happens due to improper access control, meaning the system does not correctly restrict what actions authenticated users can perform via websockets.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is that an authenticated user could execute server-side methods that they are not supposed to access. This could lead to unauthorized actions being performed on the server, potentially compromising the confidentiality and integrity of data, as indicated by the CVSS score showing high confidentiality impact and low integrity impact.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade GitLab CE/EE to a fixed version. Specifically, update to versions 18.8.9 or later if you are using the 16.9.6 to before 18.8.9 range, 18.9.5 or later if you are using versions before 18.9.5, or 18.10.3 or later if you are using versions before 18.10.3.

This will prevent authenticated users from invoking unintended server-side methods through websocket connections due to improper access control.

Useful 0 Not Useful 0