BIT-gitlab-2024-8311

vendorUSosv

Improper Protection of Alternate Path in GitLab

view advisory published 2024-09-14Licence: per source

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-8311US	medium6.5	0.61% (49th)	—	2024-09-12
An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to byp…

references

External citations — patches, advisories, analysis.

https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/WEB
https://gitlab.com/gitlab-org/gitlab/-/issues/479315WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-8311WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan