MEDIUM
CVE-2024-9623
CVSS
6.5
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository.
Summary dbcve.org
This is an authorization bypass vulnerability in GitLab CE/EE where deploy keys (typically read-only credentials) can push changes to archived repositories, which should be read-only. This allows unintended write access to repositories that have been archived for preservation.
Mitigation
Upgrade GitLab to version 17.2.9, 17.3.5, 17.4.2 or later. No configuration workaround exists; the fix is in the GitLab code itself.
Weakness (CWE)
CWE-863
Incorrect Authorization
EPSS Score
0.32%
Probability of exploitation in next 30 days
25.6th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.