Security features bypass in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2024-6329

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU95533

Security features bypass in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2024-6329

Published: August 8, 2024


Vulnerability identifier: #VU95533
CSH Severity: Medium
CVSS v4: 6.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-6329
CWE-ID: CWE-254
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper path encoding. A remote user can cause the web interface to fail to render the diff correctly when the path is encoded.


Affected software

Gitlab Community Edition
GitLab Enterprise Edition

How to mitigate CVE-2024-6329

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 17.0.6, 17.1.4, 17.2.2
GitLab Enterprise Edition - addressed in versions 17.0.6, 17.1.4, 17.2.2

External References

Related Security Bulletins