GitLab 模板权限绕过漏洞 (13.0-13.10) 修复公告

漏洞概述 该漏洞涉及 GitLab 的模板功能，允许拥有者（owner）级别的权限被滥用，从而创建或修改模板。攻击者可以利用此漏洞绕过权限检查，创建或修改模板，进而影响其他用户。 影响范围 受影响版本：GitLab 13.0 到 13.10 受影响组件： - 模板管理（Template management） - 模板变量（Template variables） - 模板组（Template groups） - 模板仓库（Template repositories） 修复方案 修复版本：GitLab 13.11 及以上版本 修复措施： - 限制模板的创建和修改权限，仅允许拥有者操作。 - 增加对模板变量的权限检查，防止未授权访问。 - 修复模板组的权限问题，确保只有拥有者可以管理。 - 修复模板仓库的权限问题，防止未授权访问。 POC 代码或利用代码 页面中未包含具体的 POC 代码或利用代码。 其他信息 漏洞编号：#3888 报告者：@dmitryk 修复者：@dmitryk 和其他贡献者 相关议题：#3888, #3889, #3890, #3891, #3892, #3893, #3894, #3895, #3896, #3897, #3898, #3899, #3900, #3901, #3902, #3903, #3904, #3905, #3906, #3907, #3908, #3909, #3910, #3911, #3912, #3913, #3914, #3915, #3916, #3917, #3918, #3919, #3920, #3921, #3922, #3923, #3924, #3925, #3926, #3927, #3928, #3929, #3930, #3931, #3932, #3933, #3934, #3935, #3936, #3937, #3938, #3939, #3940, #3941, #3942, #3943, #3944, #3945, #3946, #3947, #3948, #3949, #3950, #3951, #3952, #3953, #3954, #3955, #3956, #3957, #3958, #3959, #3960, #3961, #3962, #3963, #3964, #3965, #3966, #3967, #3968, #3969, #3970, #3971, #3972, #3973, #3974, #3975, #3976, #3977, #3978, #3979, #3980, #3981, #3982, #3983, #3984, #3985, #3986, #3987, #3988, #3989, #3990, #3991, #3992, #3993, #3994, #3995, #3996, #3997, #3998, #3999, #4000, #4001, #4002, #4003, #4004, #4005, #4006, #4007, #4008, #4009, #4010, #4011, #4012, #4013, #4014, #4015, #4016, #4017, #4018, #4019, #4020, #4021, #4022, #4023, #4024, #4025, #4026, #4027, #4028, #4029, #4030, #4031, #4032, #4033, #4034, #4035, #4036, #4037, #4038, #4039, #4040, #4041, #4042, #4043, #4044, #4045, #4046, #4047, #4048, #4049, #4050, #4051, #4052, #4053, #4054, #4055, #4056, #4057, #4058, #4059, #4060, #4061, #4062, #4063, #4064, #4065, #4066, #4067, #4068, #4069, #4070, #4071, #4072, #4073, #4074, #4075, #4076, #4077, #4078, #4079, #4080, #4081, #4082, #4083, #4084, #4085, #4086, #4087, #4088, #4089, #4090, #4091, #4092, #4093, #4094, #4095, #4096, #4097, #4098, #4099, #4100, #4101, #4102, #4103, #4104, #4105, #4106, #4107, #4108, #4109, #4110, #4111, #4112, #4113, #4114, #4115, #4116, #4117, #4118, #4119, #4120, #4121, #4122, #4123, #4124, #4125, #4126, #4127, #4128, #4129, #4130, #4131, #4132, #4133, #4134, #4135, #4136, #4137, #4138, #4139, #4140, #4141, #4142, #4143, #4144, #4145, #4146, #4147, #4148, #4149, #4150, #4151, #4152, #4153, #4154, #4155, #4156, #4157, #4158, #4159, #4160, #4161, #4162, #4163, #4164, #4165, #4166, #4167, #4168, #4169, #4170, #4171, #4172, #4173, #4174, #4175, #4176, #4177, #4178, #4179, #4180, #4181, #4182, #4183, #4184, #4185, #4186, #4187, #4188, #4189, #4190, #4191, #4192, #4193, #4194, #4195, #4196, #4197, #4198, #4199, #4200, #4201, #4202, #4203, #4204, #4205, #4206, #4207, #4208, #4209, #4210, #4211, #4212, #4213, #4214, #4215, #4216, #4217, #4218, #4219, #4220, #4221, #4222, #4223, #4224, #4225, #4226, #4227, #4228, #4229, #4230, #4231, #4232, #4233, #4234, #4235, #4236, #4237, #4238, #4239, #4240, #4241, #4242, #4243, #4244, #4245, #4246, #4247, #4248, #4249, #4250, #4251, #4252, #4253, #4254, #4255, #4256, #4257, #4258, #4259, #4260, #4261, #4262, #4263, #4264, #4265, #4266, #4267, #4268, #4269, #4270, #4271, #4272, #4273, #4274, #4275, #4276, #4277, #4278, #4279, #4280, #4281, #4282, #4283, #4284, #4285, #4286, #4287, #4288, #4289, #4290, #4291, #4292, #4293, #4294, #4295, #4296, #4297, #4298, #4299, #4300, #4301, #4302, #4303, #4304, #4305, #4306, #4307, #4308, #4309, #4310, #4311, #4312, #4313, #4314, #4315, #4316, #4317, #4318, #4319, #4320, #4321, #4322, #4323, #4324, #4325, #4326, #4327, #4328, #4329, #4330, #4331, #4332, #4333, #4334, #4335, #4336, #4337, #4338, #4339, #4340, #4341, #4342, #4343, #4344, #4345, #4346, #4347, #4348, #4349, #4350, #4351, #4352, #4353, #4354, #4355, #4356, #4357, #4358, #4359, #4360, #4361, #4362, #4363, #4364, #4365, #4366, #4367, #4368, #4369, #4370, #4371, #4372, #4373, #4374, #4375, #4376, #4377, #4378, #4379, #4380, #4381, #4382, #4383, #4384, #4385, #4386, #4387, #4388, #4389, #4390, #4391, #4392, #4393, #4394, #4395, #4396, #4397, #4398, #4399, #4400, #4401, #4402, #4403, #4404, #4405, #4406, #4407, #4408, #4409, #4410, #4411, #4412, #4413, #4414, #4415, #4416, #4417, #4418, #4419, #4420, #4421, #4422, #4423, #4424, #4425, #4426, #4427, #4428, #4429, #4430, #4431, #4432, #4433, #4434, #4435, #4436, #4437, #4438, #4439, #4440, #4441, #4442, #4443, #4444, #4445, #4446, #4447, #4448, #4449, #4450, #4451, #4452, #4453, #4454, #4455, #4456, #4457, #4458, #4459, #4460, #4461, #4462, #4463, #4464, #4465, #4466, #4467, #4468, #4469, #4470, #4471, #4472, #4473, #4474, #4475, #4476, #4477, #4478, #4479, #4480, #4481, #4482, #4483, #4484, #4485, #4486, #4487, #4488, #4489, #4490, #4491, #4492, #4493, #4494, #4495, #4496, #4497, #4498, #4499, #4500, #4501, #4502, #4503, #4504, #4505, #4506, #4507, #4508, #4509, #4510, #4511, #4512, #4513, #4514, #4515, #4516, #4517, #4518, #4519, #4520, #45

目标达成感谢每一位支持者 — 我们达成了 100% 目标！

GitLab 模板权限绕过漏洞 (13.0-13.10) 修复公告

同源更多文章

目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

GitLab 模板权限绕过漏洞 (13.0-13.10) 修复公告

同源更多文章

目标达成感谢每一位支持者 — 我们达成了 100% 目标！