Sensitive Information Retention in GitLab GraphQL Logs

CVE-2024-12292

Summary

A vulnerability in GitLab CE/EE has been identified that affects various versions. This issue arises when sensitive information transmitted in GraphQL mutations is inadvertently logged within GraphQL logs. As a result, this can lead to the unintended exposure of sensitive data, raising privacy and security concerns for users. Affected versions include GitLab CE/EE from 11.0 up to 17.4.6, as well as 17.5 prior to 17.5.4 and 17.6 prior to 17.6.2. Mitigation strategies should focus on ensuring that sensitive data is adequately protected and not retained in log files.

References