CVE-2024-2191
published 2024-06-27CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1…
PriorityP429medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.43%
34.5th percentile
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 17.3.5-2 (sid) | gitlab 17.3.5-2 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 16.9 < 16.11.5 | 16.11.5 |
| gitlab | gitlab | >= 16.9.0 < 16.11.5 | 16.11.5 |
| gitlab | gitlab | >= 17.0 < 17.0.3 | 17.0.3 |
| gitlab | gitlab | >= 17.0.0 < 17.0.3 | 17.0.3 |
| gitlab | gitlab | >= 17.1 < 17.1.1 | 17.1.1 |
| gitlab | gitlab_ce | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
osv5.3MEDIUM
vendor_debian5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fjc3-h6x3-cpx9: An issue was discovered in GitLab CE/EE affecting all versions starting from 16
ghsa_unreviewed·2024-06-27
CVE-2024-2191 [MEDIUM] CWE-284 GHSA-fjc3-h6x3-cpx9: An issue was discovered in GitLab CE/EE affecting all versions starting from 16
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
OSV
CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16
osv·2024-06-27·CVSS 5.3
CVE-2024-2191 [MEDIUM] CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
GitLab
CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting f
vendor_gitlab·2024-06-27·CVSS 5.3
CVE-2024-2191 [MEDIUM] CWE-284 CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting f
CVE-2024-2191: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
Debian
CVE-2024-2191: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 16....
vendor_debian·2024·CVSS 5.3
CVE-2024-2191 [MEDIUM] CVE-2024-2191: gitlab - An issue was discovered in GitLab CE/EE affecting all versions starting from 16....
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
Scope: local
sid: resolved (fixed in 17.3.5-2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-06-27
Published