CVE-2024-8311
Improper Protection of Alternate Path in GitLab
- State
- Published
- Severity
- 6.5 Medium
- Published
- Sep 12, 2024
- Updated
- Sep 13, 2024
- Reserved
- Aug 29, 2024
Description
An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N | GitLab |
Weaknesses
- CWE-424 Improper Protection of Alternate Path
Affected Products
| Product | Versions |
|---|---|
GitLabGitLab |
|
References
- GitLab Issue #479315issue-trackingpermissions-required
- https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.