CVE-2024-7110 - Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

Back Back to CVE browser

MEDIUM

Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

Published Aug 22, 2024

6.4

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

Affected products

Vendor GitLab Product GitLab Default
unaffected
Affected
- ≥ 17.1, < 17.1.6
- ≥ 17.2, < 17.2.4
- ≥ 17.3, < 17.3.1

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
GitLab	GitLab	unaffected	Affected ≥ 17.1, < 17.1.6 ≥ 17.2, < 17.2.4 ≥ 17.3, < 17.3.1

Remediation

Vendor solution

Upgrade to versions 17.3.1, 17.2.4, 17.1.6 or above.

Weaknesses (1)

CWE-77

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48089
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/472603
issue-trackingpermissions-requiredThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48089		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/472603		issue-trackingpermissions-requiredThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Aug 22, 2024

Updated Sep 17, 2024

Reserved Jul 25, 2024

Link CVE-2024-7110

CISA Vulnrichment

Updated Aug 22, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-7110

Red Hat

No data

ENISA EUVD

Assigner GitLab

Published Aug 22, 2024

Updated Sep 17, 2024

Link EUVD-2024-48089

GitHub

No data