Arbitrary Command Execution Through Prompt Injection in GitLab EE
CVE-2024-7110

6.4MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
22 August 2024

What is CVE-2024-7110?

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

GitLab 17.1 < 17.1.6

GitLab 17.2 < 17.2.4

GitLab 17.3 < 17.3.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/472603
issue-trackingpermissions-required

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

Credit

This vulnerability has been discovered internally by GitLab team member [Dennis Appelt](hhttps://gitlab.com/dappelt).
JSON
.