CVE-2024-9164: Missing Authentication for Critical Function in GitLab
First published: Fri Oct 11 2024(Updated: )
An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=12.5.0<17.2.9 | |
| GitLab | >=12.5.0<17.2.9 | |
| GitLab | >=17.3.0<17.3.5 | |
| GitLab | >=17.3.0<17.3.5 | |
| GitLab | >=17.4.0<17.4.2 | |
| GitLab | >=17.4.0<17.4.2 |
Remedy
Upgrade to versions 17.2.9, 17.3.5, 17.4.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-9164?
CVE-2024-9164 is considered a critical vulnerability due to its potential to allow unauthorized execution of arbitrary pipeline code.
How do I fix CVE-2024-9164?
To mitigate CVE-2024-9164, upgrade your GitLab instance to versions later than 17.2.9, 17.3.5, or 17.4.2, depending on your current version.
What types of GitLab versions are affected by CVE-2024-9164?
CVE-2024-9164 affects GitLab EE and CE versions starting from 12.5 and before several specified versions ranging from 17.2.9 to 17.4.2.
What kind of exploit does CVE-2024-9164 enable?
CVE-2024-9164 enables the running of pipelines on arbitrary branches, which could lead to unauthorized access and potential data manipulation.
Are both community and enterprise versions of GitLab vulnerable to CVE-2024-9164?
Yes, both GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) versions are vulnerable under the specified conditions in CVE-2024-9164.
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-9164
- alias/CVE-2024-6678
- alias/CVE-2024-6385
- alias/CVE-2024-5655
- agent/remedy
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- collector/the-register
- source/The Register
- alias/CVE-2023-20198
- alias/CVE-2023-42793
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/trending
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/12.5.0
- version/gitlab/17.3.0
- version/gitlab/17.4.0