Tech

What changed

GitLab has acknowledged a significant vulnerability related to improper access control in its Community and Enterprise Editions. This flaw allows password reset emails to be sent to unverified email addresses, posing a risk to user account security.

The issue affects numerous versions of GitLab, specifically those from 16.1 through 16.7, with various minor version thresholds that need to be addressed.

Who is affected

The vulnerability impacts a wide range of users and organizations utilizing GitLab's software, particularly those running outdated versions.

This includes both individual developers and enterprises relying on GitLab for version control and collaboration.

• GitLab Community Edition users
• GitLab Enterprise Edition users
• Organizations using GitLab for software development
• Developers relying on GitLab for project management and version control

What to do

It is crucial for affected users to upgrade to the latest versions of GitLab to mitigate the risks associated with this vulnerability. Regular updates are essential to ensure the security and integrity of user accounts.

Users should also review their email verification processes and consider implementing additional security measures to protect sensitive information.

• Upgrade to GitLab versions 16.1.6, 16.2.9, 16.3.7, 16.4.5, 16.5.6, 16.6.4, or 16.7.2 or later.
• Implement email verification processes for user accounts.
• Regularly monitor security advisories from GitLab for updates on vulnerabilities.

What changed

A significant command injection vulnerability has been identified in Ivanti Connect Secure and Ivanti Policy Secure. This flaw allows authenticated administrators to craft specific requests that can execute arbitrary code on the affected devices.

This vulnerability is particularly concerning as it can be exploited in conjunction with another identified issue, CVE-2023-46805, which allows authenticated bypass, thereby increasing the risk of unauthorized access.

Who is affected

The vulnerability impacts several products and their users, posing a substantial risk to organizations utilizing these systems.

Affected entities include:

• Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure
• Ivanti Policy Secure
• Organizations that rely on these products for secure remote access and policy enforcement
• Administrators managing these systems who may inadvertently expose their environments to exploitation

What to do

Organizations using Ivanti Connect Secure and Policy Secure should take immediate action to mitigate the risks associated with this vulnerability.

It is crucial to monitor for updates from Ivanti and apply any patches or security updates as they become available.

• Review security configurations and access controls for affected systems.
• Implement monitoring to detect unusual activities that could indicate exploitation attempts.
• Educate administrators about the risks and ensure they follow best practices for system management.