CVE-2024-9164

Missing Authentication for Critical Function (CWE-306)

Published: Oct 11, 2024 / Updated: 39d ago

Summary: GitLab has released critical security updates in versions 17.4.2, 17.3.5, and 17.2.9 for both Community and Enterprise Editions to address several significant vulnerabilities, including a critical flaw (CVE-2024-9164) that could allow unauthorized access to pipelines. These updates address several significant vulnerabilities, including a critical severity flaw (CVE-2024-9164) that could allow attackers to run pipelines on arbitrary branches, posing a major security risk to affected instances.

On October 10, 2024, Sangfor FarSight Labs received notification that a GitLab component contains information of Permission Bypass Vulnerability (CVE-2024-9164), classified as Critical in threat level. Support is provided for the proactive detection of GitLab; and it is capable of batch identifying the affected asset conditions of this event in business scenarios.

Henry Schein has finally disclosed a data breach following at least two back-to-back cyber attacks in 2023 by the BlackCat Ransomware gang, revealing that over 160,000 people had their personal information stolen. October 2024 saw several high-profile cyber attacks, ransomware incidents, and data breaches, affecting a range of industries from healthcare and finance to retail and government.

Update Mon Oct 28 14:36:14 UTC 2024

Gitlab has released a security update to address a critical-severity vulnerability (CVE-2024-9164) in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches. LatePoint plugin for WordPress has been updated to address two critical-severity vulnerabilities affecting versions up to and including 5.0.12.

High Vulnerabilities Primary Vendor — Product Description Published CVSS Score Source Info Patch Info adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47410 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47411 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47412 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. 2024-10-09 7.8 CVE-2024-47413 psirt@adobe.com adobe — animate Animate versions 23.0.7, 24.0.4 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.