CVE-2024-11668: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming results. The vulnerability was discovered internally by GitLab team members, Dylan Griffith and Heinrich Lee Yu (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) according to NVD assessment with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, while GitLab Inc. assessed it as 4.2 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N. The vulnerability is associated with CWE-613 (Insufficient Session Expiration) (NVD).

The vulnerability could allow unauthorized access to streaming results through long-lived connections that bypass authentication controls. This primarily affects the confidentiality and integrity of the system, with potential for unauthorized access to sensitive data (GitLab Release).

The vulnerability requires network access and has been rated with low attack complexity according to the NVD assessment, though GitLab's assessment indicates high attack complexity. No privilege requirements or user interaction is needed for exploitation according to the NVD scoring (NVD).

The vulnerability has been patched in GitLab versions 17.4.5, 17.5.3, and 17.6.1. GitLab strongly recommends that all self-managed GitLab installations be upgraded to one of these versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).