CVE-2024-8974

Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/482843	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:17.4.0::::community:::
	cpe:2.3:a:gitlab:gitlab:17.4.0::::enterprise:::

History

04 Oct 2024, 17:30

Type	Values Removed	Values Added
CWE		CWE-863
First Time		Gitlab gitlab Gitlab
CVSS	v2 : ~~unknown~~ v3 : ~~2.6~~	v2 : unknown v3 : 4.3
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/482843 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/482843 - Broken Link
CPE		cpe:2.3:a:gitlab:gitlab:17.4.0::::enterprise::: cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:17.4.0::::community::: cpe:2.3:a:gitlab:gitlab:::::community:::*

26 Sep 2024, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-09-26 23:15

Updated : 2024-10-04 17:30

NVD link : CVE-2024-8974

Mitre link : CVE-2024-8974

CVE.ORG link : CVE-2024-8974

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

CWE-684

Incorrect Provision of Specified Functionality

{"id": "CVE-2024-8974", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 2.6, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.2}]}, "published": "2024-09-26T23:15:03.083", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/482843", "tags": ["Broken Link"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-684"}]}], "descriptions": [{"lang": "en", "value": "Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\""}, {"lang": "es", "value": "Divulgaci\u00f3n de informaci\u00f3n en Gitlab EE/CE que afecta a todas las versiones desde la 15.6 anterior a la 17.2.8, la 17.3 anterior a la 17.3.4 y la 17.4 anterior a la 17.4.1: en condiciones espec\u00edficas era posible revelar a un usuario no autorizado la ruta de un proyecto privado."}], "lastModified": "2024-10-04T17:30:18.803", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "CF1537ED-2DE1-4781-ABD4-64816E5CE8D4", "versionEndExcluding": "17.2.8", "versionStartIncluding": "15.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "84ADBC3D-7A98-453A-8F34-FF810842EDCA", "versionEndExcluding": "17.2.8", "versionStartIncluding": "15.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "FBB47BC0-FE38-4628-B4C2-DA89EC467CF8", "versionEndExcluding": "17.3.4", "versionStartIncluding": "17.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "27CB6247-D7EE-40BB-BF4A-8CE5350E31BF", "versionEndExcluding": "17.3.4", "versionStartIncluding": "17.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "4FEBC1F7-0AAA-4CA2-B099-3F4218900FB3"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "3AC3130C-A3AA-403A-85D9-92FD2B8BC091"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}