Security Vulnerability in GitLab Exposes Limited Information of Exported Groups or Projects

CVE-2024-7091

5MEDIUM

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
24 July 2024

Summary

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where it was possible to disclose limited information of an exported group or project to another user.

Affected Version(s)

GitLab < 17.0.5

GitLab < 17.1.3

GitLab < 17.2.1

Refferences

https://gitlab.com/gitlab-org/gitlab/-/issues/408469
issue-trackingpermissions-required

CVSS V3.1

Score:
5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability was found internally by a GitLab team member [James Nutt](hhttps://gitlab.com/jnutt).
.