by Kastro
Paper/Archive/CVE-2024-9164

CVE-2024-9164

GitLab GitLab — Missing Authentication for Critical Function in GitLab

EPSS 1%CVSS 9.6
critical.is priorityof 100
42
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 64.0.640 × 2012.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

Affected

ProductAffectedFixed inSource
GitLab12.5 – < 17.2.917.2.9CNA
GitLab17.3 – < 17.3.517.3.5CNA
GitLab17.4 – < 17.4.217.4.2CNA

Scores by source

GitLab (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refgitlab.com/gitlab-org/gitlab/-/issues/493946exploithackerone.com/reports/2711204