Our news and updates

In GitLab EE versions 12.9 to 17.1.6, 17.2 to 17.2.4, and 17.3 to 17.3.1 a medium severity vulnerability CVE-2024-4612 was detected. This vulnerability allows attackers to perform an open redirect, which could potentially lead to an account takeover by disrupting the OAuth flow. To fix this issue users must upgrade to versions 17.1.7, 17.2.5, or 17.3.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-4612.

In GitLab versions starting from 16.5 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a medium severity vulnerability CVE-2024-4472 was detected. This vulnerability allows attackers to potentially access and view dependency proxy credentials by examining GraphQL logs, which could lead to unauthorized access to internal resources or further exploitation of the system. To fix this issue, users should upgrade GitLab to versions 17.1.7, 17.2.5, 17.3.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-4472.

In GitLab versions starting from 11.1 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a high severity vulnerability CVE-2024-4283 was detected. This vulnerability allows attackers to bypass the OAuth authorization process and gain access to user accounts. To fix this issue, users should upgrade GitLab to versions 17.1.7, 17.2.5, 17.3.2, or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-4283.

In GitLab CE/EE versions 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2, a medium severity vulnerability CVE-2024-6389 was detected. This vulnerability allows attackers with guest user access to view commit information through the release Atom endpoint, bypassing proper permission checks. To address this issue, it is recommended to update to versions 17.1.7, 17.2.5, or 17.3.2. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-6389.

In Mattermost Desktop App versions up to and including 5.8.0 a medium severity vulnerability CVE-2024-39613 was found. This issue allows local attackers to run remote code by placing a malicious cmd.exe file in the Downloads folder on a user’s machine. Currently, there is no fix version for this issue. For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-39613.

In GitLab EE versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 a medium severity vulnerability CVE-2024-8311 was detected. This vulnerability allows authenticated users to bypass variable overwrite protection in GitLab EE pipelines using a CI/CD template. To fix this problem, users should upgrade to version 17.2.5, 17.3.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8311.

In GitLab CE/EE versions 16.4 to 17.3.2 a high severity vulnerability CVE-2024-8124 was detected. This vulnerability in GitLab CE/EE could cause a Denial of Service through a specific POST request. To fix this problem, users should upgrade to version 17.3.2 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-8124.

In GitLab CE/EE versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2 a low severity vulnerability CVE-2024-6685 was detected. This vulnerability allows unauthorized attackers to gain access to sensitive group runner information. To fix this problem, users should upgrade GitLab to version 17.1.7, 17.2.5, 17.3.2, or later. For additional details, visit https://nvd.nist.gov/vuln/detail/CVE-2024-6685.

In GitLab CE/EE versions from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2 a medium severity vulnerability CVE-2024-8641 was detected. This vulnerability allows attackers with a victim’s CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim. To fix this issue users should upgrade GitLab CE/EE to version 17.1.7, 17.2.5, or 17.3.2 For more details, visit https://avd.aquasec.com/nvd/2024/cve-2024-8641.