{"id":116796,"date":"2024-06-27T12:05:43","date_gmt":"2024-06-27T10:05:43","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimost-v-gitlab-pozvolyayushhaya-zapustit-pipeline-raboty-pod-drugim-polzovatelem"},"modified":"2024-06-27T12:05:43","modified_gmt":"2024-06-27T10:05:43","slug":"uyazvimost-v-gitlab-pozvolyayushhaya-zapustit-pipeline-raboty-pod-drugim-polzovatelem","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimost-v-gitlab-pozvolyayushhaya-zapustit-pipeline-raboty-pod-drugim-polzovatelem","title":{"rendered":"Vulnerability in GitLab Allowing Pipeline Jobs to Run Under Another User","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Corrective updates for the collaborative development platform have been released \u2014 GitLab 17.1.1, 17.0.3, 16.11.5, 16.10.8, 16.9.9, 16.8.8, 16.7.8, and 16.6.8, fixing 14 vulnerabilities. One of the issues (CVE-2024-5655), which appears starting from GitLab version 15.8, has been assigned a critical danger level. This vulnerability allows pipeline jobs to execute under arbitrary users. Performing actions in the context of another user enables an attacker to access that user's internal repositories and private projects.<\/p>\n
Vulnerability details have been reported to GitLab as part of the ongoing bug bounty program on HackerOne. Detailed information about the vulnerability is planned to be disclosed 30 days after the fix is published. <\/p>\n
Additionally, it is noteworthy that the released GitLab updates have fixed three vulnerabilities rated as high severity: JavaScript code injection (XSS) in commit notes, the organization of calls to the GraphQL API on behalf of the victim when opening a specially crafted page (CSRF), and the leakage of content from private repositories through the use of search in public projects. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"