CVE-2024-8311 — Improper Protection of Alternate Path in Gitlab

CWE-424 — Improper Protection of Alternate Path4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 86.71%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedSep 12

Description

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab17.2 — 17.2.5+1
▶NVDgitlab/gitlab17.2.0 — 17.2.5+1
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-947f-qh3g-pcj5: An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17↗2024-09-12
▶

📋Vendor Advisories

2
GitLab
CVE-2024-8311: An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which all↗2024-09-12
▶
Debian
CVE-2024-8311: gitlab - An issue was discovered with pipeline execution policies in GitLab EE affecting ...↗2024
▶