MEDIUM
CVE-2024-6502
CVSS
6.5
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag.
Summary dbcve.org
GitLab CE/EE fails to properly validate branch names against deleted tags, allowing an attacker to create a branch using a name that previously existed as a deleted tag. This creates potential reference confusion and could be exploited for social engineering or repository management confusion attacks.
Mitigation
Upgrade GitLab to version 17.1.6, 17.2.4, or 17.3.1 or later to resolve the improper validation of branch names against deleted tag references.
Weakness (CWE)
CWE-684
EPSS Score
0.37%
Probability of exploitation in next 30 days
30.8th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.