{"id":6200,"date":"2024-09-12T17:56:57","date_gmt":"2024-09-12T23:56:57","guid":{"rendered":"https:\/\/beaconlab.mx\/?post_type=publicacion&#038;p=6200"},"modified":"2024-10-21T19:44:19","modified_gmt":"2024-10-22T00:44:19","slug":"2024-32-critical-vulnerability-in-gitlab","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/","title":{"rendered":"Alert 2024-32 Critical Vulnerability in GitLab"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">GitLab has publicly disclosed several vulnerabilities affecting both the <strong>Community Edition (CE)<\/strong> and <strong>Enterprise Edition (EE)<\/strong> in their on-premise implementations, some of which are critical.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">One of the most notable is <strong>CVE-2024-6678<\/strong>, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private repositories and triggering supply chain issues. The vulnerability affects GitLab versions from <strong>8.14<\/strong> to those prior to <strong>17.1.7<\/strong>, <strong>17.2.5<\/strong>, and <strong>17.3.2<\/strong>, and has a <strong>CVSS score of 9.9<\/strong>, categorizing it as critical in severity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">For more details on the vulnerabilities and mitigations, visit: <a href=\"https:\/\/about.gitlab.com\/releases\/categories\/releases\/\" title=\"\">GitLab Security Releases<\/a>.<\/p>\n","protected":false},"featured_media":6201,"template":"","class_list":["post-6200","publicacion","type-publicacion","status-publish","has-post-thumbnail","hentry"],"acf":[],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<link rel=\"canonical\" href=\"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Beacon Lab - CSIRT by Cybolt\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab\" \/>\n\t\t<meta property=\"og:description\" content=\"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png\" \/>\n\t\t<meta property=\"og:image:width\" content=\"875\" \/>\n\t\t<meta property=\"og:image:height\" content=\"612\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2024-09-12T23:56:57+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2024-10-22T00:44:19+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@BeaconLabMX\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab\" \/>\n\t\t<meta name=\"twitter:description\" content=\"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#listItem\",\"name\":\"Alert 2024-32 Critical Vulnerability in GitLab\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#listItem\",\"position\":2,\"name\":\"Alert 2024-32 Critical Vulnerability in GitLab\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#listItem\",\"name\":\"Home\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"telephone\":\"+528007374357\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.mx\\\/wp-content\\\/uploads\\\/2023\\\/12\\\/BeaconLab_V2-03.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/twitter.com\\\/BeaconLabMX\",\"https:\\\/\\\/www.linkedin.com\\\/showcase\\\/beaconlabmx\"]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#webpage\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/\",\"name\":\"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab\",\"description\":\"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#breadcrumblist\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/wp-content\\\/uploads\\\/2024\\\/09\\\/open-graph-gitlab.png\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#mainImage\",\"width\":875,\"height\":612},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/publication\\\/2024-32-critical-vulnerability-in-gitlab\\\/#mainImage\"},\"datePublished\":\"2024-09-12T17:56:57-06:00\",\"dateModified\":\"2024-10-21T19:44:19-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/\",\"name\":\"Beacon Lab\",\"description\":\"CSIRT by Cybolt\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/beaconlab.us\\\/en\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab","description":"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private","canonical_url":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BreadcrumbList","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","position":1,"name":"Home","item":"https:\/\/beaconlab.us\/en\/","nextItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#listItem","name":"Alert 2024-32 Critical Vulnerability in GitLab"}},{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#listItem","position":2,"name":"Alert 2024-32 Critical Vulnerability in GitLab","previousItem":{"@type":"ListItem","@id":"https:\/\/beaconlab.us\/en\/#listItem","name":"Home"}}]},{"@type":"Organization","@id":"https:\/\/beaconlab.us\/en\/#organization","name":"Beacon Lab","description":"CSIRT by Cybolt","url":"https:\/\/beaconlab.us\/en\/","telephone":"+528007374357","logo":{"@type":"ImageObject","url":"https:\/\/beaconlab.mx\/wp-content\/uploads\/2023\/12\/BeaconLab_V2-03.png","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#organizationLogo"},"image":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#organizationLogo"},"sameAs":["https:\/\/twitter.com\/BeaconLabMX","https:\/\/www.linkedin.com\/showcase\/beaconlabmx"]},{"@type":"WebPage","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#webpage","url":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/","name":"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab","description":"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/beaconlab.us\/en\/#website"},"breadcrumb":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#breadcrumblist"},"image":{"@type":"ImageObject","url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png","@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#mainImage","width":875,"height":612},"primaryImageOfPage":{"@id":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/#mainImage"},"datePublished":"2024-09-12T17:56:57-06:00","dateModified":"2024-10-21T19:44:19-06:00"},{"@type":"WebSite","@id":"https:\/\/beaconlab.us\/en\/#website","url":"https:\/\/beaconlab.us\/en\/","name":"Beacon Lab","description":"CSIRT by Cybolt","inLanguage":"en-US","publisher":{"@id":"https:\/\/beaconlab.us\/en\/#organization"}}]},"og:locale":"en_US","og:site_name":"Beacon Lab - CSIRT by Cybolt","og:type":"article","og:title":"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab","og:description":"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private","og:url":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/","og:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png","og:image:secure_url":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png","og:image:width":875,"og:image:height":612,"article:published_time":"2024-09-12T23:56:57+00:00","article:modified_time":"2024-10-22T00:44:19+00:00","twitter:card":"summary_large_image","twitter:site":"@BeaconLabMX","twitter:title":"Alert 2024-32 Critical Vulnerability in GitLab - Beacon Lab","twitter:description":"GitLab has publicly disclosed several vulnerabilities affecting both the Community Edition (CE) and Enterprise Edition (EE) in their on-premise implementations, some of which are critical. One of the most notable is CVE-2024-6678, a vulnerability in pipeline job execution. This flaw allows an attacker with low privileges to execute jobs as another user, potentially compromising private","twitter:image":"https:\/\/beaconlab.us\/wp-content\/uploads\/2024\/09\/open-graph-gitlab.png"},"aioseo_meta_data":{"post_id":"6200","title":null,"description":null,"keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"WebPage","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2024-10-17 23:42:56","updated":"2025-09-24 06:14:27","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/beaconlab.us\/en\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tAlert 2024-32 Critical Vulnerability in GitLab\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/beaconlab.us\/en\/"},{"label":"Alert 2024-32 Critical Vulnerability in GitLab","link":"https:\/\/beaconlab.us\/en\/publication\/2024-32-critical-vulnerability-in-gitlab\/"}],"_links":{"self":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6200","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion"}],"about":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/types\/publicacion"}],"version-history":[{"count":1,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6200\/revisions"}],"predecessor-version":[{"id":7522,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/publicacion\/6200\/revisions\/7522"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media\/6201"}],"wp:attachment":[{"href":"https:\/\/beaconlab.us\/en\/wp-json\/wp\/v2\/media?parent=6200"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}