PT-2024-7875 · Gitlab · Gitlab Ce/Ee+1
Joaxcar
·
Published
2024-08-29
·
Updated
2024-09-16
·
CVE-2024-8640
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GitLab EE versions 16.11 through 17.1.7
GitLab EE versions 17.2 through 17.2.5
GitLab EE versions 17.3 through 17.3.2
Description
An issue has been discovered in GitLab EE due to incomplete input filtering, allowing command injection into a connected Cube server. This issue affects various versions of GitLab EE, making them vulnerable to remote command injection via the Cube Server Handler.
Recommendations
For GitLab EE versions 16.11 through 17.1.7, upgrade to version 17.1.7 or later to mitigate the risk.
For GitLab EE versions 17.2 through 17.2.5, upgrade to version 17.2.5 or later to mitigate the risk.
For GitLab EE versions 17.3 through 17.3.2, upgrade to version 17.3.2 or later to mitigate the risk.
As a temporary workaround, consider restricting access to the connected Cube server until a patch is applied.
Exploit
Fix
Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitlab
Gitlab Ce/Ee