GitLab has released security updates to address 14 security flaws, including one critical vulnerability that could be exploited to run continuous integration and continuous deployment (CI/CD) pipelines as any user. The weaknesses, which affect GitLab Community Edition (CE) and Enterprise Edition (EE), have been addressed in versions 17.1.1, 17.0.3, and 16.11.5. The most severe of the vulnerabilities is CVE-2024-5655 (CVSS score: 9.6), which could permit a malicious actor to trigger a pipeline as another user under certain circumstances. It impacts the following versions of CE and EE – 17.1 prior to 17.1.1 17.0 prior to 17.0.3, and 15.8 prior to 16.11.5 GitLab said the fix introduces two breaking changes as a result of which GraphQL authentication using CI_JOB_TOKEN is disabled by default and pipelines will no longer run automatically when a merge request is re-targeted after its previous target branch is merged. Some of the other important flaws fixed as part of the latest release are listed below – CVE-2024-4901 (CVSS score: 8.7) – A stored XSS vulnerability could be imported from a project with malicious commit notes CVE-2024-4994 (CVSS score: 8.1) – A CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations CVE-2024-6323 (CVSS score: 7.5) – An authorization flaw in the global search feature that allows for leakage of sensitive information from a private repository within a public project CVE-2024-2177 (CVSS score: 6.8) – A cross…Read More