← back
CVE-2024-8311

Improper Protection of Alternate Path in GitLab

CVSS 6.5 MEDIUMEPSS 0.5%CWE-424
An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Affected products
GitLab · GitLab

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/https://gitlab.com/gitlab-org/gitlab/-/issues/479315