CVE-2024-0402: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
First published: Fri Jan 26 2024(Updated: )
An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.0.0<16.5.8 | |
| GitLab | >=16.0.0<16.5.8 | |
| GitLab | >=16.6.0<16.6.6 | |
| GitLab | >=16.6.0<16.6.6 | |
| GitLab | >=16.7.0<16.7.4 | |
| GitLab | >=16.7.0<16.7.4 | |
| GitLab | =16.8.0 | |
| GitLab | =16.8.0 |
Remedy
Upgrade to versions 16.8.1, 16.7.4, 16.6.6, 16.5.8 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-0402?
CVE-2024-0402 is considered a critical vulnerability due to its ability to allow authenticated users to write files to arbitrary locations on the GitLab server.
How do I fix CVE-2024-0402?
To fix CVE-2024-0402, upgrade to GitLab versions 16.6.6, 16.7.4, or 16.8.1 or later.
Who is affected by CVE-2024-0402?
CVE-2024-0402 affects all versions of GitLab CE/EE from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1.
What type of access is required to exploit CVE-2024-0402?
Exploitation of CVE-2024-0402 requires authenticated user access to the GitLab server.
What are the potential risks of CVE-2024-0402?
The potential risks of CVE-2024-0402 include unauthorized file creation and modification on the GitLab server, which could lead to data breaches or service disruption.
- agent/remedy
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.0.0
- version/gitlab/16.6.0
- version/gitlab/16.7.0
- version/gitlab/16.8.0