CVE-2024-2434

published 2024-04-25

CVE-2024-2434: An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where…

Priority P2 62 high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I N A H

An issue has been discovered in GitLab affecting all versions of GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1 where path traversal could lead to DoS and restricted file read.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 17.3.5-2 (sid)	gitlab 17.3.5-2 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	>= 16.10 < 16.10.4	16.10.4
gitlab	gitlab	>= 16.10.0 < 16.10.4	16.10.4
gitlab	gitlab	>= 16.11 < 16.11.1	16.11.1
gitlab	gitlab	>= 16.9 < 16.9.6	16.9.6
gitlab	gitlab	>= 16.9.0 < 16.9.6	16.9.6
gitlab	gitlab_ce	—	—

Detection & IOCs extracted from sources · hover to see the quote

• → Detect path traversal attempts targeting GitLab CE/EE endpoints, which could indicate exploitation of CVE-2024-2434 leading to DoS or restricted file read ↗

• · Affected versions are GitLab CE/EE 16.9 prior to 16.9.6, 16.10 prior to 16.10.4, and 16.11 prior to 16.11.1; fixed in 16.9.6, 16.10.4, and 16.11.1 respectively ↗
• · Debian sid resolved the issue with package version fixed in 17.3.5-2 ↗
• · Red Hat has marked the affected package (openshift4/ose-console) as 'Will not fix' for Red Hat OpenShift Container Platform 4 ↗

CVSS provenance

nvd v3.1 8.1 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

osv 8.1 HIGH

vendor_debian 8.5 HIGH

vendor_redhat 8.5 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22