CVE-2024-8647 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

CVE-2024-8647

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab PUBLISHED

Description (CNA)

An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 15.2 before 17.4.6; affected 17.5 before 17.5.4; affected 17.6 before 17.6.2

CWE

CWE-22

References

https://gitlab.com/gitlab-org/gitlab/-/issues/486051
https://hackerone.com/reports/2666341

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.