Arbitrary Command Execution Through Prompt Injection in GitLab EE

CVE-2024-7110

6.4MEDIUM

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 22 August 2024

Summary

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

Affected Version(s)

GitLab < 17.1.6

GitLab < 17.2.4

GitLab < 17.3.1

Refferences

https://gitlab.com/gitlab-org/gitlab/-/issues/472603

issue-trackingpermissions-required

CVSS V3.1

Score:

6.4

Severity:

MEDIUM

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published
Aug 22, 2024

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability has been discovered internally by GitLab team member [Dennis Appelt](hhttps://gitlab.com/dappelt).