CRITICAL
CVE-2024-6385
CVSS
9.8
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
Summary dbcve.org
A vulnerability in GitLab CI/CD pipelines allows an authenticated attacker to trigger pipelines as another user, enabling privilege escalation through pipeline execution context impersonation. The vulnerability stems from insufficient authorization controls in the pipeline triggering mechanism.
Mitigation
Upgrade GitLab to version 16.11.6, 17.0.4, 17.1.2 or later to apply the security patch. Prioritize upgrades on instances with external users or where pipeline permissions are sensitive.
Weakness (CWE)
CWE-284
Improper Access Control
EPSS Score
6.09%
Probability of exploitation in next 30 days
93.1th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.