CVE-2024-3959
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.
Summary dbcve.org
GitLab CE/EE versions 16.7 through 17.1.0 contained an access control flaw where private job artifacts could be accessed by any authenticated user rather than only authorized users. This is a broken access control vulnerability allowing unauthorized disclosure of potentially sensitive build artifacts.
Mitigation
Upgrade GitLab to version 16.11.5, 17.0.3, 17.1.1 or later. In the interim, review artifact access logs for unauthorized access attempts and consider restricting artifact download permissions at the project level.