CVE-2024-6329

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, which causes the web interface to fail to render the diff correctly when the path is encoded.

CVSS v3.1

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS v3.1

5.7 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

0.39% chance of exploitation in the next 30 days, 32th percentile

Published

2024-08-08

Updated

2024-08-29

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2542483

References

• CVE Record
• NVD entry

Related

• CVE-2024-6324
• CVE-2024-6330
• CVE-2024-6308
• CVE-2024-6333
• CVE-2024-6307
• CVE-2024-6334