Tech · 4 d ago
BalticServers.com · CC BY-SA 3.0 · Wikimedia Commons
US agency says hackers are exploiting a maximum-severity GitLab flaw
Severity score of the GitLab flaw
10.0 out of 10 on the CVSS scale
The US Cybersecurity and Infrastructure Security Agency (CISA) added the GitLab flaw to its list of exploited vulnerabilities. Rated 10.0 out of 10, it lets an unauthenticated attacker run code on a GitLab server through a crafted CI/CD configuration.
CISA also listed a Cisco firewall flaw, rated 8.6, that lets an attacker force a device to reload. Cisco said it learned of attacks on it earlier this month.
What to do
GitLab has released fixed versions 19.4.2, 19.3.5 and 19.2.8. US federal agencies must apply the fixes by Nov 1, and CISA urged private companies to patch too.
