GitLab CE/EE Insufficient Session Expiration Vulnerability in Virtual Registry Credentials Validation

A vulnerability exists in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 18.2 prior to 18.9.6, 18.10 prior to 18.10.4, and 18.11 prior to 18.11.1. This vulnerability allows users to access Virtual Registries using invalidated or incorrectly scoped credentials under certain conditions.

Impact

Exploitation of this vulnerability could lead to unauthorized access to Virtual Registries using invalidated or incorrectly scoped credentials.

Remediation

Users are advised to upgrade to GitLab CE/EE versions 18.11.1, 18.10.4, or 18.9.6. Instructions for updating GitLab can be found on the GitLab Update page.