CVE-2024-11931

Friday, January 24, 2025

6.4

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Summary

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint.

Affected Software

Vendor	Product	Version Range	Status
GitLab	GitLab	`17.0 < 17.6.4`	affected
GitLab	GitLab	`17.7 < 17.7.3`	affected
GitLab	GitLab	`17.8 < 17.8.1`	affected

Weaknesses

CWE-1220: CWE-1220: Insufficient Granularity of Access Control

ADP Enrichment

CISA ADP Vulnrichment

SSVC:
Exploitation: none
- Automatable: no
- Technical Impact: partial

Additional References

https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/https://about.gitlab.com/releases/2025/01/22/patch-release-gitlab-17-8-1-released/

References

https://gitlab.com/gitlab-org/gitlab/-/issues/480901

Feedback

Was this page helpful?

Glad to hear it! Please tell us how we can improve.

Sorry to hear that. Please tell us how we can improve.