VulnerabilityModified

CVE-2024-6446

A crafted URL could be used to trick a victim to trust an attacker controlled application.

LOW 3.5EPSS 0.41%

Does this matter?

Lower severity and a low EPSS score (0.41%). Track it; it rarely justifies an emergency change on its own.

Description

An issue has been discovered in GitLab affecting all versions starting from 17.1 to 17.1.7, 17.2 prior to 17.2.5 and 17.3 prior to 17.3.2. A crafted URL could be used to trick a victim to trust an attacker controlled application.

CVSS 3.1: 3.5 LOWCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
EPSS: 0.41% probability · 34th percentile
CISA KEV: Not listed
Weakness: CWE-840
Affected: gitlab/gitlab
Source: cve@gitlab.com

References

https://gitlab.com/gitlab-org/gitlab/-/issues/470144Broken Link
https://hackerone.com/reports/2573481Permissions Required
https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.