CVE-2024-4278 — Incorrect Synchronization in Gitlab

CWE-821 — Incorrect SynchronizationCWE-662 — Improper Synchronization4 documents4 sources
Severity
2.7LOWNVD
EPSS
0.0%
top 87.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedSep 26

Description

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:NExploitability: 1.2 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.5 — 17.2.8+2
▶NVDgitlab/gitlab16.5.0 — 17.2.8+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-vfph-fvw4-j4xp: An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16↗2024-09-26
▶

📋Vendor Advisories

2
GitLab
CVE-2024-4278: An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4,↗2024-09-26
▶
Debian
CVE-2024-4278: gitlab - An information disclosure issue has been discovered in GitLab EE affecting all v...↗2024
▶