GitLab揭露高風險漏洞，未經身分驗證的攻擊者可發動XSS攻擊接管帳號
支付動態 · 2024-05-24
本週GitLab針對社群版（CE）及企業版（EE）發布更新，修補一系列漏洞，其中最值得留意的部分，是能藉由IDE工具觸發的高風險漏洞CVE-2024-4835，若不修補，攻擊者可用於洩漏使用者機密資訊
5月22日GitLab發布社群版（CE）及企業版（EE）的17.0.1、16.11.3、16.10.6更新，當中修補7個漏洞，其中有1個被列為高風險層級，而特別值得留意。
這項高風險漏洞是CVE-2024-4835，為一鍵點擊的帳號挾持漏洞，攻擊者可製作惡意網頁，在未經身分驗證的情況下，利用Visual Studio Code程式碼編輯器（網頁IDE）觸發漏洞進行跨網站指令碼（XSS）攻擊，從而洩漏使用者機敏資訊，進而有機會接管帳號，CVSS風險評為8.0分。
其餘中等層級的漏洞當中，危險程度較高的是：runner說明欄位的阻斷服務（DoS）漏洞CVE-2024-2874、K8s叢集整合的跨網站偽造請求（CSRF）漏洞CVE-2023-7045等，上述漏洞的CVSS風險評分為6.5、5.4。
Popular articles
Manila delivers: Highlights from SiGMA Asia 2026
Southeast Asia
Institutional Academy that exceeded expectations marked the opening of GAT CDMX
Online Game
Online gambling, crypto pose ongoing money laundering risks in Philippines, analyst says
Southeast Asia
GAT Expo CDMX 2026 Kicks Off Today in Mexico with a Sold-Out Opening Reception at Big Bola Casino Santa Fe
Marketing
GAT CDMX 2025 Institutional Academy: Leaders and Experts Analyze the Present and Future of the Gaming Industry in Mexico and Lat
Sports Game
1spin4win releases unique slot Don Catleone Hold and Win featuring gangster cats
Online Game
Full House at GAT Expo Cartagena 2026 Academic Agenda
Online Game
What’s on the SBC Summit Conference Agenda in 2026?
Marketing
Zenith partners with HUIDU for 2026 World Cup Carnival Official Tour
Online Game
JILI Partners with Cricket Legend AB de Villiers (ABD) to Launch Exclusive Branded Game Series 100% 11
Sports Game
Global Game Connect (GGC) 2027 Officially Opens Sponsorship & Exhibition Opportunities in Sri Lanka!
HUIDU Focus
B2B Tech Infrastructure Gains Momentum in Philippine Gaming Sector
Southeast Asia
British gambling levy rates confirmed for each vertical
Regulation
Vietnam's tightening online gaming policy creates new market opportunities
Southeast Asia
Are you ready to maximize your earnings? Try ProPush.me Constructor!
Marketing
