CVE-2024-6595

LOW

GitLab CE/EE <16.11.6/<17.0.4/<17.1.2 - Info Disclosure

Title source: llm
STIX 2.1

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.8 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 where it was possible to upload an NPM package with conflicting package data.

References (2)

Scores

CVSS v3 3.0
EPSS 0.0007
EPSS Percentile 21.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-451 CWE-434
Status published
Products (1)
gitlab/gitlab 11.8.0 - 16.11.6 (2 CPE variants)
Published Jul 17, 2024
Tracked Since Feb 18, 2026