Back

CVE-2024-2434

April 25, 2024, 1:18 p.m.

Awaiting Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

GitLab CE/EE

  • 16.9 - 16.9.6
  • 16.10 - 16.10.4
  • 16.11 - 16.11.1

GitLab CE/EE

  • 16.9.0 - 16.9.5
  • 16.10.0 - 16.10.3
  • 16.11.0

Source

cve@gitlab.com

Tags

CVE-2024-2434 details

Published : April 25, 2024, 11:15 a.m.
Last Modified : April 25, 2024, 1:18 p.m.

Description

An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.

CVSS Score

1 2 3 4 5 6 7 8.5 9 10

Weakness

Weakness Name Description

CVSS Data

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

HIGH

Base Score

8.5

Exploitability Score

Impact Score

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H

References

URL Source
https://gitlab.com/gitlab-org/gitlab/-/issues/450303 cve@gitlab.com
https://hackerone.com/reports/2401952 cve@gitlab.com
This website uses the NVD API, but is not approved or certified by it.