CVE-2024-6678Authentication Bypass by Spoofing in Gitlab

Severity
8.8HIGHNVD
EPSS
0.1%
top 68.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 12
Latest updateOct 10

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

CVEListV5gitlab/gitlab8.1417.1.7+2
NVDgitlab/gitlab8.14.017.1.7+2
debiandebian/gitlab< gitlab 17.3.5-2 (sid)
gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-ph8h-4mq7-vw5v: An issue was discovered in GitLab CE/EE affecting all versions starting from 82024-09-12
OSV
CVE-2024-6678: An issue was discovered in GitLab CE/EE affecting all versions starting from 82024-09-12

📋Vendor Advisories

3
Red Hat
gitlab: Arbitrary Pipeline Trigger in GitLab2024-09-12
GitLab
CVE-2024-6678: An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting fr2024-09-12
Debian
CVE-2024-6678: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 8.1...2024

🕵️Threat Intelligence

2
Bleepingcomputer
GitLab warns of critical arbitrary branch pipeline execution flaw2024-10-10
Bleepingcomputer
GitLab warns of critical pipeline execution vulnerability2024-09-12