CVE-2024-11931: 
GitLab vulnerability analysis and mitigation

A medium severity vulnerability (CVE-2024-11931) was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. The vulnerability allows users with developer role to potentially exfiltrate protected CI/CD variables via CI lint under certain conditions (GitLab Release).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. It is classified under CWE-1220 (Insufficient Granularity of Access Control). The issue specifically affects the CI lint functionality in GitLab, where developers who normally cannot run pipelines on protected branches could potentially access protected CI variables (NVD, GitLab Release).

The vulnerability allows developers to exfiltrate protected CI/CD variables through the CI lint functionality, potentially exposing sensitive configuration data that should be restricted to higher privilege levels (Security Online).

GitLab has released patches in versions 17.8.1, 17.7.3, and 17.6.4 for both Community Edition (CE) and Enterprise Edition (EE). Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers do not need to take action (GitLab Release).