cbcvebase.
CVE-2024-0402
published 2024-01-26

CVE-2024-0402: An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an…

PriorityP263critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
3.30%
87.0th percentile
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.

Affected

11 ranges
VendorProductVersion rangeFixed in
debiangitlab< gitlab 16.6.6-1 (sid)gitlab 16.6.6-1 (sid)
gitlabgitlab
gitlabgitlab
gitlabgitlab>= 16.0 < 16.5.816.5.8
gitlabgitlab>= 16.0.0 < 16.5.816.5.8
gitlabgitlab>= 16.6 < 16.6.616.6.6
gitlabgitlab>= 16.6.0 < 16.6.616.6.6
gitlabgitlab>= 16.7 < 16.7.416.7.4
gitlabgitlab>= 16.7.0 < 16.7.416.7.4
gitlabgitlab>= 16.8 < 16.8.116.8.1
gitlabgitlab_ce

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace — monitor for unexpected file writes outside of expected workspace directories during workspace creation operations.
  • Affected GitLab CE/EE versions: 16.0 up to (not including) 16.6.6, 16.7 up to (not including) 16.7.4, and 16.8 up to (not including) 16.8.1 — flag unpatched instances in asset inventory.
  • CVSS score of 9.9 (critical) — prioritize detection and patching of GitLab instances in this version range.
  • ·Exploitation requires an authenticated user — unauthenticated access alone is insufficient to trigger this vulnerability.
  • ·Debian sid resolves the issue with package version 16.6.6-1; other distributions may have different fix packaging.

CVSS provenance

nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
osv9.9CRITICAL
vendor_debian9.9CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.