Arbitrary Command Execution Through Prompt Injection in GitLab EE

CVE-2024-7110
6.4MEDIUM

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
22 August 2024

Summary

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

Affected Version(s)

GitLab < 17.1.6

GitLab < 17.2.4

GitLab < 17.3.1

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Risk change from: null to: 6.4 - (MEDIUM)

  • Vulnerability published.

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability has been discovered internally by GitLab team member [Dennis Appelt](hhttps://gitlab.com/dappelt).
.