CVE-2024-6356 Details
Description
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which allowed cross project access for Security policy bot.
A vulnerability in GitLab EE allows the 'gitlab-security-policy-bot' to bypass cross-project access restrictions and execute CI/CD pipelines in other projects. This issue affects all versions from 16.0 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. The vulnerability arises because the 'CI_JOB_TOKEN' of the security policy bot can be used to access private repositories and CI variables, and to trigger pipelines that control deployments and environments.
Users can update to GitLab versions 17.2.2 or 17.1.4 to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 5, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/469108 | [email protected] | ExploitIssue Tracking |
| https://hackerone.com/reports/2575051 | [email protected] | Permissions Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-286 | Incorrect User Management | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| gitlab gitlab | >= 16.0.0, < 17.0.6 >= 17.1.0, < 17.1.4 >= 17.2.0, < 17.2.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Aug 6, 2025 | Initial Analysis | [email protected] |
| Feb 5, 2025 | New CVE Received | [email protected] |