PTA Issues GitLab Vulnerabilities Warning for High-Risk Security Flaws

The Pakistan Telecommunication Authority (PTA) has issued a critical GitLab vulnerabilities warning, alerting developers and organizations to several high-risk flaws discovered in GitLab’s Community Edition (CE) and Enterprise Edition (EE). These vulnerabilities impact a broad range of versions—from 8.0 up to releases prior to 17.4.2—and pose serious cybersecurity risks.

According to PTA, two major vulnerabilities—CVE-2023-3441 and CVE-2024-5005—have been identified. The first, CVE-2023-3441, stems from insufficient security notifications when merge permissions are granted for protected branches, potentially enabling unauthorized changes to crucial project code. The second, CVE-2024-5005, allows remote authenticated users to exploit GitLab’s API and access sensitive project content like templates.

These issues, classified as high-severity vulnerabilities, fall under the category of information disclosure. The GitLab vulnerabilities warning stresses that cybercriminals could exploit these flaws to infiltrate software development environments, compromising organizational data, source code, and intellectual property.

Cybersecurity experts emphasize the importance of promptly applying the latest patches to avoid unauthorized access and data breaches. GitLab addressed both CVEs in version 17.4.2, released on October 9, 2024, and the PTA strongly advises all GitLab users to upgrade to this or newer versions available on the official GitLab website.

The advisory underlines the need for organizations to regularly update their systems and adopt proactive cybersecurity measures. Failing to patch known vulnerabilities could leave systems open to exploitation by attackers aiming to access protected information.

PTA concluded by urging all GitLab users in Pakistan to immediately review their current installations, implement the recommended updates, and follow secure development practices to mitigate potential threats.