Developer Tools

In GitLab versions starting from 16.0 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 a medium severity vulnerability CVE-2024-4099 was detected. This vulnerability allows attackers to exploit an AI feature in GitLab to inject malicious content, potentially compromising the integrity of the system. To fix this issue, users should upgrade GitLab to versions 17.2.8, 17.3.4, or 17.4.1. For more details, visit https://nvd.nist.gov/vuln/detail/cve-2024-4099.

In Maven Archetype Plugin versions from 3.2.1 before 3.3.0 a medium severity vulnerability CVE-2024-47197 was detected. This vulnerability allows attackers to gain access to sensitive information, including user credentials, stored insecurely in the archetype-settings.xml file. To fix this issue, users must upgrade to version 3.3.0. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-47197.

In GitLab Enterprise Edition versions starting from 16.5 and prior to 17.2.8, from 17.3 and prior to 17.3.4, and from 17.4 and prior to 17.4.1 a medium severity vulnerability CVE-2024-4278 was detected. This vulnerability allows a maintainer to obtain a Dependency Proxy password by editing specific settings. To address this issue, it is recommended to update to versions 17.2.8, 17.3.4, or 17.4.1 or higher. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-4278.

In OpenShift environments using QEMU NBD Server versions a high severity vulnerability CVE-2024-7409 was detected. This vulnerability allows attackers to perform a denial of service (DoS) attack by exploiting improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. Currently, there is no fix version for that issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-7409.

In GitLab versions starting from 13.3 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a medium severity vulnerability CVE-2024-2743 was detected. This vulnerability allows attackers to unauthorized modify on-demand DAST scans, potentially leading to the leakage of sensitive variables and compromising the security of the system. To fix this issue, users should upgrade GitLab to versions 17.1.7, 17.2.5, 17.3.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-2743.

In GitLab EE versions 11.2 to 17.1.6, 17.2 to 17.2.4, and 17.3 to 17.3.1 a high severity vulnerability CVE-2024-4660 was detected. This vulnerability allows attackers with guest access to read the source code of private projects using group templates. To fix this issue users should upgrade GitLab EE to version 17.1.7, 17.2.5, or 17.3.2, depending on the version currently in use. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-4660.

In GitLab EE versions 12.9 to 17.1.6, 17.2 to 17.2.4, and 17.3 to 17.3.1 a medium severity vulnerability CVE-2024-4612 was detected. This vulnerability allows attackers to perform an open redirect, which could potentially lead to an account takeover by disrupting the OAuth flow. To fix this issue users must upgrade to versions 17.1.7, 17.2.5, or 17.3.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-4612.

In GitLab versions starting from 16.5 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a medium severity vulnerability CVE-2024-4472 was detected. This vulnerability allows attackers to potentially access and view dependency proxy credentials by examining GraphQL logs, which could lead to unauthorized access to internal resources or further exploitation of the system. To fix this issue, users should upgrade GitLab to versions 17.1.7, 17.2.5, 17.3.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-4472.

In GitLab versions starting from 11.1 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a high severity vulnerability CVE-2024-4283 was detected. This vulnerability allows attackers to bypass the OAuth authorization process and gain access to user accounts. To fix this issue, users should upgrade GitLab to versions 17.1.7, 17.2.5, 17.3.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-4283.