CVE-2024-7110: Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab
An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.
Other sources
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, allows an attacker to execute arbitrary command in a victim’s pipeline through prompt injection. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.4). It is now mitigated in the latest release and is assigned CVE-2024-7110.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-7110?
CVE-2024-7110 has a critical severity due to the potential for arbitrary command execution.
How do I fix CVE-2024-7110?
To fix CVE-2024-7110, upgrade GitLab to version 17.2.4 or 17.3.1 or later.
What versions of GitLab are affected by CVE-2024-7110?
CVE-2024-7110 affects GitLab EE versions 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1.
What type of vulnerability is CVE-2024-7110?
CVE-2024-7110 is a prompt injection vulnerability that allows attackers to execute arbitrary commands.
How can attackers exploit CVE-2024-7110?
Attackers can exploit CVE-2024-7110 by injecting malicious commands into a victim's pipeline.