CVE-2024-2434: 
GitLab vulnerability analysis and mitigation

A path traversal vulnerability has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1. The vulnerability was discovered on April 24, 2024, and could lead to Denial of Service (DoS) and restricted file read capabilities (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 8.1 HIGH (NIST) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H, while GitLab Inc. assessed it at 8.5 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD).

The vulnerability could allow attackers to perform Denial of Service (DoS) attacks and gain access to restricted file read capabilities, potentially compromising system security and availability (GitLab Release).

The vulnerability requires low attack complexity and low privileges to exploit, with no user interaction needed. The attack vector is network-accessible (NVD).

GitLab has released patches in versions 16.9.6, 16.10.4, and 16.11.1. It is strongly recommended that all affected installations be upgraded to one of these patched versions immediately. GitLab.com has already been updated to run the patched version (GitLab Release).

The vulnerability was responsibly disclosed through GitLab's HackerOne bug bounty program by security researcher 'pwnie'. GitLab has classified this as a high-severity security issue and promptly addressed it in their security patch release (GitLab Release).