SecuriTricks - CVE-2024-10240

Description

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.

Product(s) Impacted

Vendor	Product	Versions
Gitlab	Gitlab	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	gitlab	gitlab	/	/	/	/	community	/	/	/
a	gitlab	gitlab	/	/	/	/	enterprise	/	/	/
a	gitlab	gitlab	/	/	/	/	community	/	/	/
a	gitlab	gitlab	/	/	/	/	enterprise	/	/	/
a	gitlab	gitlab	/	/	/	/	community	/	/	/
a	gitlab	gitlab	/	/	/	/	enterprise	/	/	/

References

https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#information-disclosure-through-an-api-endpoint

https://gitlab.com/gitlab-org/gitlab/-/issues/493188

CVSS Score

5.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: NONE
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

View Vector String

Timeline

Published: Nov. 26, 2024, 8:15 p.m.
Last Modified: Dec. 13, 2024, 1:37 a.m.

Status : Analyzed

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@gitlab.com

CVE-2024-10240