[Update] Multiple Vulnerabilities in GitLab (January 12, 2024)

unknownCVE-2024-0402

[Update on January 29, 2024] On January 25, 2024, the vendor published a security advisory regarding several vulnerabilities affecting GitLab CE and EE. The vulnerability CVE-2024-0402 is considered critical with a CVSSv3 score of 9.9. It allows an authenticated attacker to write...

CSIRTS triage

vendor: GitLab product: GitLabOther

What: A critical vulnerability has been identified in GitLab.
Who is affected: All GitLab installations, both Community and Enterprise Editions.
Urgency: Remediation is urgent due to the critical nature of the vulnerability.
Action: Monitor for updates and apply patches as they become available.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch GitLab

Get an email when a new GitLab advisory drops — max one per day, one-click unsubscribe.

Details

Source: CERT-FR Alertes de sécurité (FR · national-cert · site)
Severity: unknown
Published: 2024-01-12
Exploitation: Not in CISA KEV at last sync
Language: Machine-translated to English — verify against the original

Original advisory: https://www.cert.ssi.gouv.fr/alerte/CERTFR-2024-ALE-002/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Moderate exploitation riskCVE-2024-04023.3% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 87% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2024-0402	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

criticalGitLab Critical Security Release: 16.8.1, 16.7.4, 16.6.6, 16.5.8gitlab

Recent advisories for GitLab

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownNCSC-2026-0222 [1.00] [M/H] Vulnerabilities fixed in GitLab Enterprise Edition and Community Editionncsc-nl · 2026-07-10
high[NEW] [high] GitLab: Multiple vulnerabilitiescert-bund · 2026-07-09
unknownMultiple vulnerabilities in GitLab (July 09, 2026)cert-fr-avis · 2026-07-09
mediumCVE-2026-8472: GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19…nvd · 2026-07-08
mediumCVE-2026-7492: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, …nvd · 2026-07-08
highCVE-2026-6896: GitLab has remediated an issue in GitLab EE affecting all versions from 13.11 before 18.11.7, 1…nvd · 2026-07-08