CVE-2024-5435 — Information Exposure via Error Message in Gitlab

CWE-209 — Information Exposure via Error Message5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 82.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedSep 12

Description

An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5gitlab/gitlab15.10 — 17.1.7+2
▶NVDgitlab/gitlab15.10.0 — 17.1.7+2
▶debiandebian/gitlab< gitlab 17.3.5-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
OSV
CVE-2024-5435: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15↗2024-09-12
▶
GHSA
GHSA-mc42-9p8q-pxff: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15↗2024-09-12
▶

📋Vendor Advisories

2
GitLab
CVE-2024-5435: An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 befo↗2024-09-12
▶
Debian
CVE-2024-5435: gitlab - An issue has been discovered discovered in GitLab EE/CE affecting all versions s...↗2024
▶