CVE-2024-12380 — Information Exposure via Error Message in Gitlab

CWE-209 — Information Exposure via Error Message5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.0%
top 86.27%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedMar 13

Description

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab11.5 — 17.7.7+2
▶NVDgitlab/gitlab11.5.0 — 17.7.7+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-jj7w-rgj3-p8jw: An issue was discovered in GitLab EE/CE affecting all versions starting from 11↗2025-03-13
▶
OSV
CVE-2024-12380: An issue was discovered in GitLab EE/CE affecting all versions starting from 11↗2025-03-13
▶

📋Vendor Advisories

2
GitLab
CVE-2024-12380: An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all ve↗2025-03-13
▶
Debian
CVE-2024-12380: gitlab - An issue was discovered in GitLab EE/CE affecting all versions starting from 11....↗2024
▶