CVE-2024-3976 — Missing Authorization in Gitlab

CWE-862 — Missing Authorization5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 87.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedFeb 5

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab14.0 — 16.9.7+2
▶NVDgitlab/gitlab14.0.0 — 16.9.7+2
▶debiandebian/gitlab< gitlab 17.3.5-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2024-3976: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14↗2025-02-05
▶
GHSA
GHSA-px4x-cjpp-hqv5: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14↗2025-02-05
▶

📋Vendor Advisories

2
GitLab
CVE-2024-3976: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and star↗2025-02-05
▶
Debian
CVE-2024-3976: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions starting fro...↗2024
▶