PT-2024-37586 · Gitlab · Gitlab Ce/Ee+1

Ashish_R_Padelkar · Published 2024-09-12 · Updated 2024-09-14 · CVE-2024-6389

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab-CE/EE versions 17.0 through 17.1.7 GitLab-CE/EE versions 17.2 through 17.2.5 GitLab-CE/EE versions 17.3 through 17.3.2

Description An issue was discovered in GitLab-CE/EE where an attacker, as a guest user, was able to access commit information via the "release Atom endpoint", contrary to permissions.

Recommendations For versions 17.0 through 17.1.7, update to version 17.1.7 or later. For versions 17.2 through 17.2.5, update to version 17.2.5 or later. For versions 17.3 through 17.3.2, update to version 17.3.2 or later. As a temporary workaround, consider restricting access to the release Atom endpoint until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

BIT-GITLAB-2024-6389

CVE-2024-6389

Affected Products

Gitlab

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6389.json · Exploit
• 🔥 https://hackerone.com/reports/2573397 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-6389 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-6389 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6389 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6389 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6389 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-6389 · Vendor Advisory
• https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released · Note
• https://t.me/cvenotify/94639 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/469367 · Note
• https://twitter.com/CVEnew/status/1834279484087845169 · Twitter Post
• https://t.me/cvedetector/5499 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1834308759763472607 · Twitter Post