GitLab Releases Patch for Critical CI/CD Pipeline Vulnerability

There are 14 security flaws that GitLab has addressed with security updates on pipeline Vulnerability.

One of the vulnerabilities is considered critical as it enables users to operate continuous integration and continuous deployment (CI/CD) pipelines while posing as any user.

Versions 17.1.1, 17.0.3, and 16.11.5 have resolved the vulnerabilities impacting both GitLab Community Edition (CE) and Enterprise Edition (EE).

Under specific circumstances, a malicious actor may initiate a pipeline as another user through CVE-2024-5655 (with CVSS score of 9.6), which is considered the most critical security flaw.

The affected versions of CE and EE are impacted by this:

• 17.1 prior to 17.1.1
• 17.0 prior to 17.0.3, and
• 15.8 prior to 16.11.5

Versions 17.1.1, 17.0.3, and 16.11.5 have resolved the vulnerabilities impacting both GitLab Community Edition (CE) and Enterprise Edition (EE).

Under specific circumstances, a malicious actor may initiate a pipeline as another user through CVE-2024-5655 (with CVSS score of 9.6), which is considered the most critical security flaw.

The affected versions of CE and EE are impacted by this:

• A security flaw identified as CVE-2024-4901 (CVSS score: 8.7) could allow for a stored XSS attack to occur due to the potential importation of malicious commit notes from a project.
• The global search function is vulnerable to an authorization flaw with the CVE-2024-6323 identifier and a CVSS score of 7.5, which permits sensitive data from private repositories within public projects to leak.
• A vulnerability with CVE-2024-2177 (CVSS score: 6.8) allows an attacker to exploit the OAuth authentication flow by utilizing a specially crafted payload, resulting in cross-window forgery attacks.
• Involving a CVSS score of 8.1, CVE-2024-4994 is related to an occurrence of CSRF assault on the GraphQL API belonging to GitLab. This breach results in unintended and unrestricted enactments of distinct GraphQL mutations with arbitrary contents accessible by third parties or unauthorized users.

Although there is no indication that the flaws are currently being exploited, it’s advised for users to implement the patches as a precautionary measure against probable threats.