CVE-2024-8402: 
GitLab vulnerability analysis and mitigation

CVE-2024-8402 is a security vulnerability discovered in GitLab Enterprise Edition (EE) affecting versions from 17.2 before 17.7.7, versions from 17.8 before 17.8.5, and versions from 17.9 before 17.9.2. The vulnerability stems from an input validation issue in the Google Cloud IAM integration feature that could potentially allow a Maintainer to introduce malicious code (NVD, GitLab Release).

The vulnerability is classified as a low-severity issue with a CVSS v3.1 base score of 3.7 (LOW) and vector string CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N. It is categorized under CWE-77 (Improper Neutralization of Special Elements used in a Command Injection) (NVD).

The vulnerability could enable a Maintainer to introduce malicious code through the Google Cloud IAM integration feature, potentially compromising the security of the affected GitLab installation (GitLab Release).

The vulnerability has been patched in GitLab versions 17.7.7, 17.8.5, and 17.9.2. Users are strongly recommended to upgrade to these versions immediately. GitLab.com is already running the patched version, and GitLab Dedicated customers will be notified once their instance has been patched (GitLab Release).