GitLab EE Server-Side Request Forgery Vulnerability in Virtual Registry

A server-side request forgery (SSRF) vulnerability has been identified in GitLab Enterprise Edition (EE) versions 18.0 prior to 18.6.6, 18.7 prior to 18.7.4, and 18.8 prior to 18.8.4. Under certain conditions, this vulnerability could have allowed an authenticated user with specific permissions to make unauthorized requests to internal network services via the GitLab server.

Impact

Exploitation of this vulnerability could lead to unauthorized access or manipulation of internal network services.

Remediation

GitLab users are strongly advised to upgrade to version 18.8.4, 18.7.4, or 18.6.6. Instructions for updating GitLab can be found on the GitLab Update page.