Private Project Dependency Lists Exposed Through Job Artifacts

CVE-2024-5318

4MEDIUM

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 24 May 2024

Summary

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.11 prior to 16.10.6, starting from 16.11 prior to 16.11.3, and starting from 17.0 prior to 17.0.1. A Guest user can view dependency lists of private projects through job artifacts.

Affected Version(s)

GitLab < 16.10.6

GitLab < 16.11.3

GitLab < 17.0.1

CVSS V3.1

Score:

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

None

Attack Vector:

Local

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability Reserved.
May 24, 2024
Vulnerability published.
May 24, 2024

Collectors

NVD DatabaseMitre Database

Credit

Thanks [ricardobrito](https://hackerone.com/ricardobrito) for reporting this vulnerability through our HackerOne bug bounty program