Unauthorized Access to Kubernetes Agent in GitLab CE/EE Clusters

CVE-2024-9693

8.5HIGH

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 14 November 2024

Summary

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.0 prior to 17.3.7, starting from 17.4 prior to 17.4.4, and starting from 17.5 prior to 17.5.2, which could have allowed unauthorized access to the Kubernetes agent in a cluster under specific configurations.

Affected Version(s)

GitLab < 17.3.7

GitLab < 17.4.4

GitLab < 17.5.2

CVSS V3.1

Score:

8.5

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Risk change from: null to: 8.5 - (HIGH)
Nov 15, 2024
Vulnerability published.
Nov 14, 2024

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability was found internally by a GitLab team member [Tiger Watson](https://gitlab.com/tigerwnz).