An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace.
References
| Link | Resource |
|---|---|
| https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/437819 | Broken Link |
| https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ | Vendor Advisory |
| https://gitlab.com/gitlab-org/gitlab/-/issues/437819 | Broken Link |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 08:46
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - Vendor Advisory | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/437819 - Broken Link |
31 Jan 2024, 18:34
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-22 | |
| References | () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - Vendor Advisory | |
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/437819 - Broken Link | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.9 |
| CPE | cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:* |
26 Jan 2024, 01:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-01-26 01:15
Updated : 2024-11-21 08:46
NVD link : CVE-2024-0402
Mitre link : CVE-2024-0402
CVE.ORG link : CVE-2024-0402
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')