VULNERABILITY INTELLIGENCE

CVE-2024-8311

CVSS score6.5 MEDIUM
EPSS probability0.61%
CISA KEVNot currently listed
Published2024-09-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

An issue was discovered with pipeline execution policies in GitLab EE affecting all versions from 17.2 prior to 17.2.5, 17.3 prior to 17.3.2 which allows authenticated users to bypass variable overwrite protection via inclusion of a CI/CD template.

Weakness classification

  • cve@gitlab.com: CWE-424
  • nvd@nist.gov: NVD-CWE-noinfo

Primary references