CVE-2024-6595
LOWGitLab CE/EE <16.11.6/<17.0.4/<17.1.2 - Info Disclosure
Title source: llmDescription
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.
Scores
CVSS v3
3.0
EPSS
0.0009
EPSS Percentile
26.0%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
Classification
CWE
CWE-451
CWE-434
Status
published
Affected Products (2)
gitlab/gitlab
< 16.11.6
gitlab/gitlab
< 16.11.6
Timeline
Published
Jul 17, 2024
Tracked Since
Feb 18, 2026