CVE-2024-6678: critical vulnerability in GitLab
Authentication Bypass by Spoofing in GitLab
Published · Updated
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9epss 2.0%
from disclosure to weapon616 days
Published on NVDSep 12
1st PoC+616d
exploitation probability
2.0%top 20% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
GitLab · GitLabpublic PoCs found — 2
githubgithub.com/FaLLenSKiLL1/CVE-2024-6678★ 4cve_referencehackerone.com/reports/2595495unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GitLab
In the same product, most dangerous first.
CVE-2021-22205CRITICALCVE-2021-22205EPSS 99.7%KEVCVE-2023-7028CRITICALWeak Password Recovery Mechanism for Forgotten Password in GitLabEPSS 94.6%KEVCVE-2026-85706CRITICALImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabEPSS 93.0%KEVCVE-2021-22175MEDIUMCVE-2021-22175EPSS 53.4%KEVCVE-2021-39935MEDIUMCVE-2021-39935EPSS 36.1%KEVCVE-2023-2442HIGHCVE-2023-2442EPSS 96.1%