CVE-2024-8974 — Incorrect Provision of Specified Functionality in Gitlab

CWE-684 — Incorrect Provision of Specified FunctionalityCWE-863 — Incorrect Authorization5 documents5 sources
Severity
4.3MEDIUMNVD
EPSS
0.1%
top 80.45%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab EE
Timeline
PublishedSep 26
Latest updateSep 27

Description

Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages5 packages

▶CVEListV5gitlab/gitlab15.6 — 17.2.8+2
▶NVDgitlab/gitlab15.6.0 — 17.2.8+2
▶debiandebian/gitlab< gitlab 17.3.5-3 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-vg85-gmcc-wrqw: Information disclosure in Gitlab EE/CE affecting all versions from 15↗2024-09-27
▶
OSV
CVE-2024-8974: Information disclosure in Gitlab EE/CE affecting all versions from 15↗2024-09-26
▶

📋Vendor Advisories

2
GitLab
CVE-2024-8974: Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific co↗2024-09-26
▶
Debian
CVE-2024-8974: gitlab - Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to...↗2024
▶