Token Leakage Vulnerability in GitLab CE/EE
CVE-2024-12570

6.7MEDIUM

Key Information:

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
12 December 2024

Badges

👾 Exploit Exists

Summary

CVE-2024-12570 is a high-risk vulnerability identified in GitLab CE/EE, compromising user session integrity. The flaw enables an attacker to exploit the CI_JOB_TOKEN of a victim to gain unauthorized access to their GitLab session token. This issue affects multiple versions of GitLab from version 13.7 up to 17.4.6, as well as versions 17.5 prior to 17.5.4 and 17.6 prior to 17.6.2. Organizations using these versions should prioritize patching to prevent potential exploitation.

Affected Version(s)

GitLab 13.7 < 17.4.6

GitLab 17.5 < 17.5.4

GitLab 17.6 < 17.6.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/494694
issue-trackingpermissions-required
https://hackerone.com/reports/2724948
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Thanks [yvvdwf](https://hackerone.com/yvvdwf) for reporting this vulnerability through our HackerOne bug bounty program
.