Arbitrary file read via the UploadsRewriter when moving and issue Analysed #827052 Valid File and Path Handling Critical 2020-04-27 $20,000 1,503 gitlab-workhorse bypass in Gitlab::Middleware::Multipart allowing files in `allowed_paths` to be read Analysed #850447 Valid Information Disclosure Critical 2020-06-08 $10,000 410 SSRF on project import via the remote_attachment_url on a Note Analysed #826361 Valid Server-Side Request Forgery High 2020-06-07 $10,000 359 Server Side Request Forgery mitigation bypass Analysed #632101 Valid Server-Side Request Forgery High 2020-04-18 – 350 An attacker can run pipeline jobs as arbitrary user Analysed #894569 Valid Input Validation and Logic Critical 2020-08-26 $12,000 307 Ability to bypass email verification for OAuth grants results in accounts takeovers on 3rd parties Analysed #922456 Valid Authentication High 2020-10-01 $3,000 257 Privilege escalation from any user (including external) to gitlab admin when admin impersonates you Analysed #493324 Valid Access Control Critical 2020-08-26 – 256 Full Read SSRF on Gitlab's Internal Grafana #878779 Valid Server-Side Request Forgery Critical 2020-08-07 – 229 Send arbitrary PUT requests when user clicks on a link Analysed #824689 Valid Command and Code Injection Medium 2020-07-27 – 135 Unrestricted file upload leads to Stored XSS Analysed #880099 Valid Cross-site Scripting Medium 2020-08-03 – 90 Stored XSS in "Create Groups" Analysed #647130 Valid Cross-site Scripting High 2020-08-26 $2,500 89 GitLab-Runner on Windows `DOCKER_AUTH_CONFIG` container host Command Injection Analysed #955016 Valid Command and Code Injection High 2020-11-04 – 77 [Admin Panel] CSRF to resume/pause runner Analysed #415238 Valid Cross-Site Request Forgery Low 2020-12-01 – 60 EXIF metadata not stripped from JPG group logos Analysed #446238 Valid Information Disclosure Low 2020-09-08 $500 55 Stored XSS in markdown when redacting references Analysed #836649 Valid Cross-site Scripting High 2020-09-09 $5,000 50 XSS on Issue reference numbers Analysed #831962 Valid Cross-site Scripting Medium 2020-11-23 – 49 Stored XSS in blob viewer Analysed #806571 Valid Cross-site Scripting Medium 2020-08-04 – 37 Injection of `http.<url>.*` git config settings leading to SSRF Analysed #855276 Valid Server-Side Request Forgery High 2020-09-08 $3,000 36 Store-XSS in error message of build-dependencies Analysed #950190 Valid Cross-site Scripting High 2020-12-01 – 35 Stored XSS in group issue list Analysed #859333 Valid Cross-site Scripting Medium 2020-11-21 $2,000 27 No redirect_uri in the db for web-internal clientKey leads to one-click DoS on gitter.im Analysed #702987 Valid Denial of Service Low 2020-05-15 – 26 Stored XSS on PyPi simple API endpoint Analysed #856836 Valid Cross-site Scripting Medium 2020-09-09 $3,000 25 Stealing data from customers.gitlab.com without user interaction Analysed #674195 Valid Insecure Direct Object Reference High 2020-08-26 – 25 SafeParamsHelper::safe_params is not so safe Analysed #946728 Valid Cross-site Scripting High 2020-11-02 $4,000 24 Unauthorized access to private project security dashboard Analysed #853355 Valid Information Disclosure Medium 2020-11-21 – 24 Possibilty to purchase Ultimate - 1 Year (EDU or OSS) Analysed #882848 Valid Input Validation and Logic Low 2020-11-02 – 23 CRLF injection & SSRF in git:// protocal lead to arbitrary code execution Analysed #441090 Valid Server-Side Request Forgery High 2020-11-23 – 22 Instant open redirect on Live preview WEB Ide opening #437142 Valid Open Redirect Low 2020-11-04 $1,000 20 Insufficient Type Check on GraphQL leading to Maintainer delete repository #858671 Valid Access Control High 2020-11-02 $4,000 18 Insufficient Type Check leading to Developer ability to delete Project, Repository, Group, ... #960244 Valid Memory Corruption High 2020-11-02 $5,000 16 SSRF In plantuml (on plantuml.pre.gitlab.com) #689245 Valid Server-Side Request Forgery Medium 2020-08-17 – 14 Guest users can change the confidentiality attribute on those issues that have been assigned to them #762271 Valid Access Control Low 2020-11-09 $100 13 Transferring a public group to a private group doesn't remove code from the Elastichsearch API search result #748375 Valid Access Control Medium 2020-10-06 – 13 SSRF into Shared Runner, by replacing dockerd with malicious server in Executor #809248 Valid Server-Side Request Forgery Medium 2020-09-08 – 12 Unauthorized user is able to access schedule pipeline variables and values #962462 Valid Information Disclosure High 2020-11-30 – 9 Elasticsearch leaks data through the notes scope #710006 Valid Access Control Medium 2020-10-06 – 8 Todos are not redacted when membership changes - Access to (confidential) issues and merge requests #880863 Valid Information Disclosure Medium 2020-11-02 – 7 Members from parent group keep their access level on a subgroup transfer and are invisible #790786 Valid Access Control High 2020-09-08 – 5 Initial mirror user can be assigned by other user even if the mirror was removed #819821 Valid Access Control Medium 2020-08-26 $3,000 4