CVE-2024-9164

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-9164
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9164.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-9164
Aliases
Downstream
Published
2024-10-11T11:30:42.233Z
Modified
2026-03-12T17:36:49.037496Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Missing Authentication for Critical Function in GitLab
Details

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/9xxx/CVE-2024-9164.json",
    "cwe_ids": [
        "CWE-306"
    ],
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4878f9ac8941c5ad124c9f2216897109c5dde4af
Fixed
91146650fd2d7d080662a536b1d04a5c96f451be
Database specific 
{
    "versions": [
        {
            "introduced": "12.5"
        },
        {
            "fixed": "17.2.9"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
5aad128b1defa01641e69fdcd5a2ec16bd1d4c2c
Fixed
9048fbf917815f5283436f14b221cbf91a24c63b
Database specific 
{
    "versions": [
        {
            "introduced": "17.3"
        },
        {
            "fixed": "17.3.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
22193b3da887c1fa5e49021fa8f87b74e6539a7a
Fixed
e85e7bae1a93d7b8faa2842423a4ffea2db86e87
Database specific 
{
    "versions": [
        {
            "introduced": "17.4"
        },
        {
            "fixed": "17.4.2"
        }
    ]
}

Affected versions

v17.*
v17.3.0-ee
v17.3.1-ee
v17.3.2-ee
v17.3.3-ee
v17.3.4-ee
v17.3.4-rc50-ee
v17.4.0-ee
v17.4.1-ee
v17.4.1-rc10-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-9164.json"