Authentication Bypass by Spoofing in GitLab
48Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 9.9epss 2.0%
from disclosure to weapon616 days
Published on NVDSep 12
1st PoC+616d
exploitation probability
2.0%top 21% of all CVEs
observed exploitation
nono source reports it
2 public exploit(s)
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.14 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, which allows an attacker to trigger a pipeline as an arbitrary user under certain circumstances.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
GitLab · GitLabpublic PoCs found — 2
githubgithub.com/FaLLenSKiLL1/CVE-2024-6678★ 4cve_referencehackerone.com/reports/2595495unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.