Executive Summary

This vulnerability in GitLab EE allows an authenticated attacker to trigger unauthorized pipeline executions by manipulating commits. It affects versions from 10.6 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability could allow an attacker with authentication to execute pipelines without proper authorization, potentially leading to unauthorized code execution or changes in the CI/CD process, which may compromise the integrity of software development and deployment.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update GitLab EE to a fixed version: 18.3.5 or later if using 18.3, 18.4.3 or later if using 18.4, or 18.5.1 or later if using 18.5. Avoid using affected versions from 10.6 before 18.3.5. Additionally, restrict authenticated user permissions to limit the ability to manipulate commits and trigger unauthorized pipeline executions.

Useful 0 Not Useful 0