PT-2024-5344 · Gitlab · Gitlab Ce/Ee+1

Ameya Darshan · Published 2024-07-10 · Updated 2024-08-30 · CVE-2024-6595

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.8 through 16.11.6 GitLab CE/EE versions 17.0 through 17.0.4 GitLab CE/EE versions 17.1 through 17.1.2

Description An issue was discovered where it was possible to upload an NPM package with conflicting package data. This issue is related to an uncontrolled search path element. Exploitation of this issue may allow a remote attacker to upload a package with conflicting data.

Recommendations For versions 11.8 through 16.11.6, update to a version after 16.11.6 to resolve the issue. For versions 17.0 through 17.0.4, update to a version after 17.0.4 to resolve the issue. For versions 17.1 through 17.1.2, update to a version after 17.1.2 to resolve the issue. As a temporary workaround, consider restricting the upload of NPM packages until a patch is available.

Exploit

Fix

Untrusted Search Path

UI Misrepresentation of Critical Information

Unrestricted File Upload

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-451

CWE-434

CWE-427

Related Identifiers

BDU:2024-05977

BIT-GITLAB-2024-6595

CVE-2024-6595

Affected Products

Gitlab

Gitlab Ce/Ee

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6595.json · Exploit
• 🔥 https://blog.vlt.sh/blog/the-massive-hole-in-the-npm-ecosystem · Exploit
• https://bdu.fstec.ru/vul/2024-05977 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-6595 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-6595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-6595 · Security Note
• https://osv.dev/vulnerability/CVE-2024-6595 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-6595 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-6595 · Vendor Advisory
• https://vuldb.com/?id.271798 · Note
• https://t.me/cvenotify/92825 · Telegram Post
• https://t.me/cvenotify/86745 · Telegram Post
• https://about.gitlab.com/releases/2024/07/10/patch-release-gitlab-17-1-2-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/417975 · Note
• https://t.me/cvenotify/86451 · Telegram Post