CVE-2024-6356: 
GitLab vulnerability analysis and mitigation

A security vulnerability (CVE-2024-6356) was discovered in GitLab Enterprise Edition (EE) affecting all versions from 16.0 prior to 17.0.6, from 17.1 prior to 17.1.4, and from 17.2 prior to 17.2.2. The vulnerability allowed unauthorized cross-project access through the Security policy bot (GitLab Release, NVD).

The vulnerability is related to improper access control in GitLab's Security policy bot functionality. The issue has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N. The vulnerability is classified under CWE-286 (Incorrect User Management) (NVD).

The vulnerability could allow attackers to gain unauthorized access to private repositories and CI/CD variables, as well as trigger CI/CD pipelines, potentially leading to control over deployments, environments, and packages. This creates a significant security risk for affected GitLab installations (GitLab Issue).

GitLab has addressed this vulnerability in versions 17.0.6, 17.1.4, and 17.2.2. Organizations running affected versions should upgrade immediately to the patched versions. GitLab.com has already been updated with the necessary patches (GitLab Release).