VULNERABILITY INTELLIGENCE

CVE-2024-6595

CVSS score3 LOW

EPSS probability0.51%

CISA KEVNot currently listed

Published2024-07-17

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.

Weakness classification

cve@gitlab.com: CWE-451
nvd@nist.gov: CWE-434

Primary references

cve@gitlab.com — Exploit, Third Party Advisory
cve@gitlab.com — Issue Tracking
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking