VulnerabilityModified

CVE-2024-4660

An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2.

HIGH 7.5EPSS 0.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.

CVSS 3.1: 7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.61% probability · 47th percentile
CISA KEV: Not listed
Weakness: CWE-862
Affected: gitlab/gitlab
Source: cve@gitlab.com

References

https://gitlab.com/gitlab-org/gitlab/-/issues/460892Broken Link
https://hackerone.com/reports/2480126Permissions Required
https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.