CVE-2024-6595 Uncontrolled Search Path Element in GitLab

2024-07-1701:30:43

CWE-451

GitLab

github.com

cve-2024-6595

gitlab

uncontrolled search path

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

AI Score

6.5

Confidence

Low

EPSS

0.001

Percentile

17.4%

SSVC

Exploitation

poc

Automatable

Technical Impact

partial

JSON

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.