Corrective updates for the collaborative development platform GitLab have been released ā 17.3.2, 17.2.5, and 17.1.7, addressing 17 vulnerabilities. One vulnerability has been assigned a critical severity level (9.9 out of 10), 3 are high, 11 are medium, and 2 are low. The critical vulnerability (CVE-2024-6678) allows pipeline jobs to be executed under a different user, enabling an attacker to gain access to the internal repositories and private projects of that user.
Vulnerability information has been submitted to GitLab as part of the ongoing bug bounty program on HackerOne. Detailed information about the vulnerability is planned to be disclosed 30 days after the release of the fix.
Bron: opennet.ru
