- Description
- An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.
- Source
- cve@gitlab.com
- NVD status
- Analyzed
CVSS 3.1
- Type
- Primary
- Base score
- 8.8
- Impact score
- 5.9
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Severity
- HIGH
- cve@gitlab.com
- CWE-306
- nvd@nist.gov
- NVD-CWE-noinfo
- Hype score
- Not currently trending
🔐 GitLab fixed critical flaw CVE-2024-9164. Update now to secure your CI/CD pipelines. #CyberSecurity #DevOps #GitLabUpdate https://t.co/YQDpQcS2Lq
@OffenseLogic
22 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
Have any more info on CVE-2024-9164 @gitlab ? Reference links are private/rotted/paywalled. https://t.co/aGVlD67pY4 Hope the fix is practical. Definitely running hella "arbitrary branch" pipelines daily. https://t.co/3MXiyV6Mrw
@ImpostorKeanu
47 Impressions
0 Retweets
0 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6A3DE32E-282D-463C-9117-E458316D4272",
"versionEndExcluding": "17.2.9",
"versionStartIncluding": "12.5.0"
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3352CF6D-12DF-434A-B514-A956C733FEEE",
"versionEndExcluding": "17.2.9",
"versionStartIncluding": "12.5.0"
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EE7140D0-5D8A-4EDA-91AF-5F14BC4F6307",
"versionEndExcluding": "17.3.5",
"versionStartIncluding": "17.3.0"
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A005AE5-1C1A-4515-9695-A502092BB75A",
"versionEndExcluding": "17.3.5",
"versionStartIncluding": "17.3.0"
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7132410B-A160-4C18-8BB6-E53C6A0F35D7",
"versionEndExcluding": "17.4.2",
"versionStartIncluding": "17.4.0"
},
{
"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
"vulnerable": true,
"matchCriteriaId": "08991976-707A-4A7B-863D-766928E74FF7",
"versionEndExcluding": "17.4.2",
"versionStartIncluding": "17.4.0"
}
],
"operator": "OR"
}
]
}
]