2024-064: Vulnerabilities in GitLab

2024-064: Vulnerabilities in GitLab ↗ source

June 28, 2024 CERT-EU Advisory

Source: https://cert.europa.eu/publications/security-advisories/2024-064/

Summary

GitLab pipelines are a feature of the Continuous Integration/Continuous Deployment (CI/CD) system that enables users to automatically run processes and tasks, either in parallel or in sequence, to build, vulnerability could be imported from a project with malicious commit notes. GitLab’s GraphQL API leading to the execution of arbitrary GraphQL mutations. of a private repository in a public project. The following versions of GitLab CE/EE are affected: CERT-EU strongly recommends updating software installations to the latest versions by following the instructions given by the vendor [1].

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-5655	9.6 Critical	GitLab GitLab An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting …
CVE-2024-4901	8.7 High	GitLab GitLab An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting …
CVE-2024-4994	8.1 High	GitLab GitLab An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all ve…
CVE-2024-6323	7.5 High	GitLab GitLab Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

GitLab 5 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.