CVE-2024-6595: Uncontrolled Search Path Element in GitLab
First published: Wed Jul 17 2024(Updated: )
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=11.8.0<16.11.6 | |
| GitLab | >=11.8.0<16.11.6 | |
| GitLab | >=17.0.0<17.0.4 | |
| GitLab | >=17.0.0<17.0.4 | |
| GitLab | >=17.1.0<17.1.2 | |
| GitLab | >=17.1.0<17.1.2 |
Remedy
Upgrade to versions 16.11.6, 17.0.4, 17.1.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/references
- agent/title
- agent/remedy
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- agent/softwarecombine
- agent/severity
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/11.8.0
- version/gitlab/17.0.0
- version/gitlab/17.1.0