Unauthorized Issue Status Manipulation in GitLab CE/EE Products
CVE-2024-12431

4.3MEDIUM

Key Information:

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
8 January 2025

Badges

👾 Exploit Exists🟡 Public PoC

Summary

A vulnerability exists in GitLab CE/EE that enables unauthorized users to alter the status of issues in public projects. This flaw affects all versions from 15.5 to prior to 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1. Exploitation could lead to confusion and mismanagement in project workflows, as users not authenticated to the system could manipulate issue tracking features in ways not intended by project owners.

Affected Version(s)

GitLab 15.5 < 17.5.5

GitLab 17.6 < 17.6.3

GitLab 17.7 < 17.7.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-12431 - Proof of Concept

References

https://gitlab.com/gitlab-org/gitlab/-/issues/508742
issue-trackingpermissions-required
https://about.gitlab.com/releases/2025/01/08/patch-releas...
https://hackerone.com/reports/2877710
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.