CVE-2024-6389: 
GitLab vulnerability analysis and mitigation

An issue was discovered in GitLab-CE/EE affecting all versions starting with 17.0 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. An attacker as a guest user was able to access commit information via the release Atom endpoint, contrary to permissions (GitLab Release, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The issue stems from improper access control in the release Atom endpoint, allowing guest users to view commit information that should be restricted according to GitLab's documentation (GitLab Release).

The vulnerability allows guest users to access commit information through the release Atom endpoint, which violates GitLab's documented permissions model. While guest users should only have access to GitLab Releases for downloading assets, this vulnerability exposed additional repository information that should have been restricted (GitLab Issue).

The vulnerability has been fixed in GitLab versions 17.1.7, 17.2.5, and 17.3.2. Organizations running affected versions should upgrade to the patched versions immediately. GitLab.com is already running the patched version (GitLab Release).