GitLab patches high-severity LFS token privilege-escalation flaw
Attack Tradecraft · 4 sources · Updated 4mo ago · First seen Nov 26, 2024
GitLab released patched versions 17.6.1, 17.5.3, and 17.4.5 for Community Edition and Enterprise Edition to fix multiple security issues, led by CVE-2024-8114, a high-severity privilege-escalation vulnerability involving LFS tokens. GitLab said the flaw affects a broad range of GitLab CE/EE versions and can be exploited by an attacker who has access to a victim’s Personal Access Token. The company said GitLab.com was already running the patched version, while self-managed customers were urged to upgrade immediately.
The release also addressed several medium-severity issues, including denial-of-service conditions, unintended access to usage data through scoped tokens, and an authentication weakness in a streaming endpoint. Public references in the vulnerability records include CVE-2024-8114, CVE-2024-8177, and CVE-2024-8237, tying the fixes to GitLab’s broader November security update for both CE and EE deployments.
