CVE-2024-8635

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 16.8 through 17.1.7 GitLab Enterprise Edition versions 17.2 through 17.2.5 GitLab Enterprise Edition versions 17.3 through 17.3.2

Description The issue is related to insufficient server-side request validation, allowing an attacker to perform Server-Side Request Forgery (SSRF) attacks using a custom Maven Dependency Proxy URL. This enables the attacker to make requests to internal resources.

Recommendations For GitLab Enterprise Edition versions 16.8 through 17.1.7, update to version 17.1.7 or later. For GitLab Enterprise Edition versions 17.2 through 17.2.5, update to version 17.2.5 or later. For GitLab Enterprise Edition versions 17.3 through 17.3.2, update to version 17.3.2 or later. As a temporary workaround, consider restricting access to the Maven Dependency Proxy URL to minimize the risk of exploitation.