CVE-2024-6323: Improper Isolation or Compartmentalization in GitLab
Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.5Fixed in 17.0.3Fixed in 17.1.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.11.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.0.3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.1.1 - Operational
Remove search results from public projects that include content from unauthorized/private repositories (as described for GitLab global search authorization issue CVE-2024-6323).
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-6323?
CVE-2024-6323 has a high severity rating due to improper authorization that can lead to leakage of private repository content.
How do I fix CVE-2024-6323?
To fix CVE-2024-6323, update GitLab EE to version 16.11.5 or later, 17.0.3 or later, or 17.1.1 or later.
What versions of GitLab are affected by CVE-2024-6323?
CVE-2024-6323 affects GitLab EE versions 16.11 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1.
What is the impact of CVE-2024-6323?
The impact of CVE-2024-6323 is that an attacker could potentially leak content from private repositories into public projects.
Is CVE-2024-6323 applicable to GitLab Community Edition?
No, CVE-2024-6323 specifically affects GitLab Enterprise Edition.