CVE-2024-9164: Missing Authentication for Critical Function in GitLab
An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-9164?
CVE-2024-9164 is considered a critical vulnerability due to its potential to allow unauthorized execution of arbitrary pipeline code.
How do I fix CVE-2024-9164?
To mitigate CVE-2024-9164, upgrade your GitLab instance to versions later than 17.2.9, 17.3.5, or 17.4.2, depending on your current version.
What types of GitLab versions are affected by CVE-2024-9164?
CVE-2024-9164 affects GitLab EE and CE versions starting from 12.5 and before several specified versions ranging from 17.2.9 to 17.4.2.
What kind of exploit does CVE-2024-9164 enable?
CVE-2024-9164 enables the running of pipelines on arbitrary branches, which could lead to unauthorized access and potential data manipulation.
Are both community and enterprise versions of GitLab vulnerable to CVE-2024-9164?
Yes, both GitLab Community Edition (CE) and GitLab Enterprise Edition (EE) versions are vulnerable under the specified conditions in CVE-2024-9164.