Guest User API Vulnerability Affects GitLab Versions

CVE-2024-5005

4.3MEDIUM

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
11 October 2024

Summary

An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 11.4 before 17.2.9, all versions starting from 17.3 before 17.3.5, all versions starting from 17.4 before 17.4.2 It was possible for guest users to disclose project templates using the API.

Affected Version(s)

GitLab < 17.2.9

GitLab < 17.3.5

GitLab < 17.4.2

Refferences

https://gitlab.com/gitlab-org/gitlab/-/issues/462108
issue-trackingpermissions-required
https://hackerone.com/reports/2501461
technical-descriptionexploitpermissions-required

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Thanks [js_noob](https://hackerone.com/js_noob) for reporting this vulnerability through our HackerOne bug bounty program
.