GitLab EE Vulnerable to SSRF Attacks

CVE-2024-8977

8.2HIGH

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 10 October 2024

Summary

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

Affected Version(s)

GitLab < 17.2.9

GitLab < 17.3.5

GitLab < 17.4.2

CVSS V3.1

Score:

8.2

Severity:

HIGH

Confidentiality:

High

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Changed

Timeline

Vulnerability published.
Oct 10, 2024
Vulnerability Reserved.
Sep 18, 2024

Collectors

NVD DatabaseMitre Database

Credit

Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program