HIGH
CVE-2024-8970
CVSS
8.8
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows an attacker to trigger a pipeline as another user under certain circumstances.
Summary dbcve.org
An authentication bypass in GitLab's pipeline trigger mechanism allows authenticated attackers to trigger pipelines under other users' contexts by exploiting improper user context handling during pipeline initialization.
Mitigation
Upgrade to GitLab 17.2.9, 17.3.5, or 17.4.2 or later per the version matrix. Review pipeline trigger configurations and audit recent pipeline executions for signs of unauthorized use.
Weakness (CWE)
CWE-863
Incorrect Authorization
EPSS Score
0.58%
Probability of exploitation in next 30 days
46.4th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.