CVE-2024-4660: Missing Authorization in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4660?
CVE-2024-4660 is classified as a high severity vulnerability due to its potential to expose private project source code.
How do I fix CVE-2024-4660?
To mitigate CVE-2024-4660, upgrade GitLab to version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later.
Who is affected by CVE-2024-4660?
CVE-2024-4660 affects all versions of GitLab EE starting from 11.2 up to but not including 17.1.7, 17.2 up to but not including 17.2.5, and 17.3 up to but not including 17.3.2.
What type of vulnerability is CVE-2024-4660?
CVE-2024-4660 is a security vulnerability that allows unauthorized access to private project source code by guests.
Can a guest user exploit CVE-2024-4660?
Yes, a guest user can exploit CVE-2024-4660 to read the source code of a private project under certain conditions.