CVE-2024-6678
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
Summary dbcve.org
GitLab CE/EE contains an authorization bypass vulnerability where an unauthenticated or authenticated attacker can trigger CI/CD pipelines as arbitrary users due to insufficient validation of pipeline trigger requests. This enables privilege escalation within the GitLab instance.
Mitigation
Upgrade GitLab to version 17.1.7, 17.2.5, 17.3.2 or later to patch the authorization flaw. If immediate upgrade is not possible, review pipeline trigger tokens and restrict pipeline trigger API access.