CVE-2024-9164

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions starting from 12.5 prior to 17.2.9, starting from 17.3, prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows running pipelines on arbitrary branches.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 12.5, < 17.2.9; >= 17.3, < 17.3.5; >= 17.4, < 17.4.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/493946Broken Link
https://hackerone.com/reports/2711204Permissions Required

Timeline

Published: Oct 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-91656.4The Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SV CVE-2024-91669.3The device enables an unauthorized attacker to execute system commands with elevated privileges. This exploit is facilitated through the use CVE-2024-91677.8Under specific circumstances, insecure permissions in Ivanti Velocity License Server before version 5.2 allows a local authenticated attacke CVE-2024-91694.8The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin debug settings in all versions up to, and i CVE-2024-91704.8The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wcj_product_meta shortcode in CVE-2024-91725.4The Demo Importer Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and inc CVE-2024-91735.4The GF Custom Style plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includ CVE-2024-91745.4Stored HTML Injection in Social Module in M-Files Hubshare before version 5.0.8.6 allows authenticated user to spoof UI CVE-2024-91775.4The Themedy Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's themedy_col, themedy_social_link, the CVE-2024-91785.4The XT Floating Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions CVE-2024-91807.2A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s priv CVE-2024-91824.8The Maspik WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as