An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
References
Link | Resource |
---|---|
https://gitlab.com/gitlab-org/gitlab/-/issues/471923 | Broken Link |
https://hackerone.com/reports/2595495 | Permissions Required |
https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/ |
Configurations
Configuration 1 (hide)
|
History
No history.
Information
Published : 2024-09-12 19:15
Updated : 2024-11-21 09:50
NVD link : CVE-2024-6678
Mitre link : CVE-2024-6678
CVE.ORG link : CVE-2024-6678
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-290
Authentication Bypass by Spoofing