CVE-2024-4660: Missing Authorization in GitLab
First published: Thu Sep 12 2024(Updated: )
An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=11.2.0<17.1.7 | |
| GitLab | >=17.2.0<17.2.5 | |
| GitLab | >=17.3.0<17.3.2 |
Remedy
Upgrade to versions 17.1.7, 17.2.5, 17.3.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4660?
CVE-2024-4660 is classified as a high severity vulnerability due to its potential to expose private project source code.
How do I fix CVE-2024-4660?
To mitigate CVE-2024-4660, upgrade GitLab to version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later.
Who is affected by CVE-2024-4660?
CVE-2024-4660 affects all versions of GitLab EE starting from 11.2 up to but not including 17.1.7, 17.2 up to but not including 17.2.5, and 17.3 up to but not including 17.3.2.
What type of vulnerability is CVE-2024-4660?
CVE-2024-4660 is a security vulnerability that allows unauthorized access to private project source code by guests.
Can a guest user exploit CVE-2024-4660?
Yes, a guest user can exploit CVE-2024-4660 to read the source code of a private project under certain conditions.
- agent/remedy
- agent/weakness
- agent/references
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/last-modified-date
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/11.2.0
- version/gitlab/17.2.0
- version/gitlab/17.3.0