GitLab flaw that lets attackers run code on servers now has a public exploit
On Oct 16, Rapid7 published an exploit for , a flaw in GitLab Community Edition and Enterprise Edition that lets an attacker run code on a GitLab server. In Rapid7’s tests on GitLab 19.4.1, the exploit runs commands as the git account, but its setup needs push access to a public project. Rapid7 says that conflicts with GitLab’s rating of no privileges required, and neither company has reported exploitation. GitLab fixed the flaw on Oct 12 in versions 19.4.2, 19.3.5 and 19.2.8 and gives it a CVSS 3.1 score of 10.0.
- Affected
- GitLab CE and EE
19.4before19.4.2,19.3before19.3.5and19.2before19.2.8. All versions and fixes - CVE
- Vendor
- GitLab
- Published
- Editor
- Austin Simas
What to do
2 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| GitLab CE and EE 19.4 | 19.4 before 19.4.2 | 19.4.2 or later |
| GitLab CE and EE 19.3 | 19.3 before 19.3.5 | 19.3.5 or later |
| GitLab CE and EE 19.2 | 19.2 before 19.2.8 | 19.2.8 or later |
- Product
- GitLab CE and EE 19.4
- Affected
19.4before19.4.2- Fixed
19.4.2or later
- Product
- GitLab CE and EE 19.3
- Affected
19.3before19.3.5- Fixed
19.3.5or later
- Product
- GitLab CE and EE 19.2
- Affected
19.2before19.2.8- Fixed
19.2.8or later
Timeline
- Oct 12GitLab releases
19.4.2,19.3.5and19.2.8with the fix. - Oct 16Rapid7 publishes its analysis and an exploit.