{"id":112853,"date":"2024-01-12T15:10:23","date_gmt":"2024-01-12T13:10:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem"},"modified":"2024-01-12T15:10:23","modified_gmt":"2024-01-12T13:10:23","slug":"uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/novosti-interneta\/uyazvimosti-v-gitlab-pozvolyayushhie-zahvatit-uchyotnuyu-zapis-i-vypolnit-komandy-pod-drugim-polzovatelem","title":{"rendered":"Vulnerabilitetet n\u00eb GitLab q\u00eb lejojn\u00eb kapjen e llogaris\u00eb dhe ekzekutimin e komandeve si nj\u00eb p\u00ebrdorues tjet\u00ebr","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Shtypi i p\u00ebrdit\u00ebsimeve korrigjuese t\u00eb platform\u00ebs p\u00ebr organizimin e zhvillimit t\u00eb bashk\u00ebveprimit \u2014 GitLab 16.7.2, 16.6.4 dhe 16.5.6, n\u00eb t\u00eb cilat jan\u00eb eliminuar dy dob\u00ebsi kritike. Dob\u00ebsia e par\u00eb (CVE-2023-7028), e cila ka nj\u00eb nivel rreziku maksimal (10 nga 10), lejon kapjen e llogarive t\u00eb tjera n\u00ebp\u00ebrmjet manipulimeve me formularin e rikuperimit t\u00eb fjal\u00ebkalimit t\u00eb humbur. Kjo dob\u00ebsi shkaktohet nga mund\u00ebsia e d\u00ebrgimit t\u00eb nj\u00eb emaili me kodin p\u00ebr rivendosjen e fjal\u00ebkalimit n\u00eb adresa emaili t\u00eb paq\u00ebna. Problemi shfaqet q\u00eb nga l\u00ebshimi i GitLab 16.1.0, n\u00eb t\u00eb cilin u prezantua mund\u00ebsia e d\u00ebrgimit t\u00eb kodit t\u00eb rikuperimit t\u00eb fjal\u00ebkalimit n\u00eb nj\u00eb email t\u00eb pav\u00ebrtetuar. <\/p>\n
P\u00ebr t\u00eb verifikuar faktet e komprometimit t\u00eb sistemeve, sugjerohet t\u00eb kontrolloni n\u00eb logun gitlab-rails\/production_json.log pranin\u00eb e k\u00ebrkesave HTTP p\u00ebr trajtuesin \/users\/password me treguesin e nj\u00eb vargu me disa email n\u00eb parametrin \u00abparams.value.email\u00bb. Po ashtu, sugjerohet t\u00eb kontrolloni pranin\u00eb n\u00eb logun gitlab-rails\/audit_json.log t\u00eb regjistrimeve me vler\u00ebn PasswordsController#create n\u00eb meta.caller.id dhe me nj\u00eb array t\u00eb disa adresave n\u00eb bllokun target_details. Sulmi nuk mund t\u00eb p\u00ebrfundoj\u00eb n\u00ebse p\u00ebrdoruesi aktivizon verifikimin e dyfisht\u00eb. <\/p>\n
Vulnerabiliteti i dyt\u00eb CVE-2023-5356 \u00ebsht\u00eb i pranish\u00ebm n\u00eb kodin p\u00ebr integrimin me sh\u00ebrbimet Slack dhe Mattermost, dhe lejon ekzekutimin e komandueseve n\u00ebn nj\u00eb p\u00ebrdorues tjet\u00ebr p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb verifikimit t\u00eb duhur t\u00eb autorizimit. Problemit i \u00ebsht\u00eb caktuar nj\u00eb nivel rrezikshm\u00ebrie prej 9.6 nga 10. N\u00eb versionet e reja gjithashtu \u00ebsht\u00eb eliminuar nj\u00eb vulnerabilitet m\u00eb pak t\u00eb rreziksh\u00ebm (7.6 nga 10) (CVE-2023-4812), q\u00eb lejon evazionin e konfirmimit t\u00eb CODEOWNERS duke shtuar ndryshime n\u00eb nj\u00eb k\u00ebrkes\u00eb p\u00ebr bashkim t\u00eb m\u00ebparshme t\u00eb miratuar. <\/p>\n
Informacione m\u00eb t\u00eb detajuara mbi vulnerabilitetet e identifikuara planifikohen t\u00eb publikohen brenda 30 dit\u00ebve pas publikimit t\u00eb p\u00ebrmir\u00ebsimit. Informacioni mbi vulnerabilitetet \u00ebsht\u00eb transmetuar n\u00eb GitLab n\u00eb kuad\u00ebr t\u00eb programit t\u00eb tij n\u00eb HackerOne p\u00ebr shp\u00ebrblim p\u00ebr zbulimin e vulnerabiliteteve. \n Burimi: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"