Description
Gitlab CI Lint API allows validating CI/CD YAML configuration from remote servers. It doesn't require authentication. An attacker may use this feature to perform SSRF (Server-side request forgery) attacks on the server.
Remediation
Upgrade to the latest version of Gitlab
References
Related Vulnerabilities
XML external entity injection via File Upload
Deserialization of Untrusted Data (Java Object Deserialization)
Zimbra Collaboration Suite SSRF (CVE-2020-7796)
WordPress Server-Side Request Forgery (SSRF) Vulnerability (CVE-2016-4029)
Deserialization of Untrusted Data (Java JSON Deserialization) Genson