GitLab released security patches for 17 vulnerabilities in GitLab CE (Community Edition) and EE (Enterprise Edition).
One of these vulnerabilities is a critical pipeline execution flaw, tracked as CVE-2024-6678 (CVSS score of 9.9), that could allow an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
“An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.” reads the company’s advisory. “It is now mitigated in the latest release and is assigned CVE-2024-6678.
yvvdwf reported the issue to the company through the company bug bounty program operated by HackerOne.
GitLab also fixed a high severity issue, tracked as CVE-2024-8640 (CVSS score of 8.5), in GitLab EE. An attacker can exploit the flaw to inject commands into a connected Cube server.
“An issue has been discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. Due to incomplete input filtering, it was possible to inject commands into a connected Cube server.” reads the advisory.
joaxcar reported this vulnerability through our HackerOne bug bounty program.
The company also fixed several medium and low-severity vulnerabilities that could lead to protection bypasses, privilege escalation, unauthorized read access to private project source code, GitLab token retrieval, account takeover, and information leaks.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, GitLab CE)
