BIT-gitlab-2024-9164

vendorUSosv

Missing Authentication for Critical Function in GitLab

view advisory published 2024-10-15Licence: per source

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-9164US	high8.8OT elevated	1.04% (64th)	—	2024-10-11
An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which a…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/493946WEB
https://hackerone.com/reports/2711204WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-9164WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan