Sensitive Information Exposure in GitLab EE by GitLab
CVE-2024-11129

6.3MEDIUM

Key Information:

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
10 April 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability in GitLab EE allows unauthorized users to utilize advanced search features, enabling them to perform targeted searches with sensitive keywords. This capability can lead to the unintended exposure of issue counts that match the searched terms, thereby inadvertently revealing information about project issues and potentially sensitive data. The issue affects multiple versions of GitLab EE, and remediation is strongly advised for all affected installations.

Affected Version(s)

GitLab 17.1 < 17.8.7

GitLab 17.9 < 17.9.6

GitLab 17.10 < 17.10.4

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-11129 - Proof of Concept

References

https://gitlab.com/gitlab-org/gitlab/-/issues/503722
issue-trackingpermissions-required
https://hackerone.com/reports/2717400
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program
.