CVE-2024-11931

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.0 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.2 GitLab CE/EE versions 17.8 through 17.8.0

Description An issue has been discovered in GitLab CE/EE that affects users with a developer role, allowing them to potentially exfiltrate protected CI variables via CI lint under certain conditions. This could enable attackers to access sensitive information.

Recommendations For GitLab CE/EE versions 17.0 through 17.6.3, update to version 17.6.4 or later to resolve the issue. For GitLab CE/EE versions 17.7 through 17.7.2, update to version 17.7.3 or later to resolve the issue. For GitLab CE/EE versions 17.8 through 17.8.0, update to version 17.8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to CI lint for users with developer roles until the issue is resolved.