CVE-2024-8647— Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

CVSS 5.4 · Medium EPSS 0.18% · P40 Updated Jan 25, 2025

Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2024-8647

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

Source: NVD (National Vulnerability Database)

Vulnerability Description

An issue was discovered in GitLab affecting all versions starting 15.2 to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2. On self hosted installs, it was possible to leak the anti-CSRF-token to an external site while the Harbor integration was enabled.

Source: NVD (National Vulnerability Database)

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Source: NVD (National Vulnerability Database)

Vulnerability Type

对路径名的限制不恰当(路径遍历)

Source: NVD (National Vulnerability Database)

Vulnerability Title

GitLab 路径遍历漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

GitLab是美国GitLab公司的一个开源的端到端软件开发平台，具有内置的版本控制、问题跟踪、代码审查、CI/CD（持续集成和持续交付）等功能。 GitLab存在路径遍历漏洞，该漏洞源于在自托管安装中，启用Harbor集成时，可能会将反跨站请求伪造令牌泄露到外部站点。

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
GitLab	GitLab	15.2 ~ 17.4.6	`cpe:2.3:a:gitlab:gitlab::::::::`

II. Public POCs for CVE-2024-8647

#	POC Description	Source Link	Shenlong Link

AI-Generated POCPremium

No public POC found.

III. Intelligence Information for CVE-2024-8647

请登录查看更多情报信息。

CSPT in Harbor artifact links lead to CSRF token leakage and ATO on selfhosted instances (#486051) · Issues · GitLab.org / GitLab · GitLabissue-trackingpermissions-required
https://nvd.nist.gov/vuln/detail/CVE-2024-8647

Same Patch Batch · GitLab · 2024-12-12 · 9 CVEs total

CVE-2024-11274	8.7 HIGH	URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVE-2024-8233	7.5 HIGH	Inefficient Algorithmic Complexity in GitLab
CVE-2024-12570	6.7 MEDIUM	Privilege Context Switching Error in GitLab
CVE-2024-9387	6.4 MEDIUM	URL Redirection to Untrusted Site ('Open Redirect') in GitLab
CVE-2024-8179	5.4 MEDIUM	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Gi
CVE-2024-9367	4.3 MEDIUM	Allocation of Resources Without Limits or Throttling in GitLab
CVE-2024-12292	4.0 MEDIUM	Insertion of Sensitive Information into Log File in GitLab
CVE-2024-10043	3.1 LOW	Incorrect Authorization in GitLab

IV. Related Vulnerabilities

Same product: GitLab

Same vendor: GitLab

Same weakness: CWE-22

V. Comments for CVE-2024-8647

No comments yet

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2024-8647— Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

I. Basic Information for CVE-2024-8647

Vulnerability Information

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Vulnerability Title

Vulnerability Description

CVSS Information

Vulnerability Type

Affected Products

II. Public POCs for CVE-2024-8647

III. Intelligence Information for CVE-2024-8647

Same Patch Batch · GitLab · 2024-12-12 · 9 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2024-8647

Leave a comment