Improper Protection of Alternate Path in GitLab

CVE-2024-8311

6.5MEDIUM

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
12 September 2024

Summary

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

Affected Version(s)

GitLab < 17.2.5

GitLab < 17.3.2

Refferences

https://gitlab.com/gitlab-org/gitlab/-/issues/479315
issue-trackingpermissions-required

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability has been discovered internally by GitLab team member Andy Schoenen
.