CVE-2024-6595: Uncontrolled Search Path Element in GitLab
First published: Wed Jul 17 2024(Updated: )
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=11.8.0<16.11.6 | |
| GitLab | >=11.8.0<16.11.6 | |
| GitLab | >=17.0.0<17.0.4 | |
| GitLab | >=17.0.0<17.0.4 | |
| GitLab | >=17.1.0<17.1.2 | |
| GitLab | >=17.1.0<17.1.2 |
Remedy
Upgrade to versions 16.11.6, 17.0.4, 17.1.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-6595?
CVE-2024-6595 has been classified as a moderate severity vulnerability.
How do I fix CVE-2024-6595?
To fix CVE-2024-6595, upgrade GitLab to version 16.11.6, 17.0.4, or 17.1.2 or later.
What versions of GitLab are affected by CVE-2024-6595?
CVE-2024-6595 affects all GitLab CE and EE versions from 11.8 prior to 16.11.6, from 17.0 prior to 17.0.4, and from 17.1 prior to 17.1.2.
What type of vulnerability is CVE-2024-6595?
CVE-2024-6595 is a vulnerability that allows the upload of an NPM package with conflicting package data.
Is CVE-2024-6595 present in GitLab's community and enterprise editions?
Yes, CVE-2024-6595 affects both community and enterprise editions of GitLab.
- agent/references
- agent/title
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/softwarecombine
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/11.8.0
- version/gitlab/17.0.0
- version/gitlab/17.1.0