Description
An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 16.0 – < 17.2.8, 17.3 – < 17.3.4, 17.4 – < 17.4.1 | 17.2.8 |
Advisories 1
- WID-SEC-2024-2219 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 25, 2024
References
- GitLab Issue #457798 issue-tracking permissions-required
- HackerOne Bug Bounty Report #2459597 technical-description exploit permissions-required