Business Logic Error in GitLab Affecting Multiple Versions
CVE-2024-9163

3.5LOW

Key Information:

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 23 May 2025

What is CVE-2024-9163?

An identified business logic error in GitLab CE/EE allows attackers to exploit a branch name confusion within confidential merge requests. This vulnerability affects all versions starting from 12.1 up to specific thresholds in later versions, posing risks where inappropriate access or visibility into sensitive information may occur. Proper mitigation steps are crucial to safeguarding confidential data from unauthorized manipulation.

Affected Version(s)

GitLab 12.1 < 17.10.7

GitLab 17.11 < 17.11.3

GitLab 18.0 < 18.0.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/493942

issue-trackingpermissions-required

https://hackerone.com/reports/2705566

technical-descriptionexploitpermissions-required

CVSS V3.1

Score:

3.5

Severity:

LOW

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Unchanged

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
May 23, 2025
Vulnerability Reserved
Sep 24, 2024

Credit

Thanks [foxribeye](https://hackerone.com/foxribeye) for reporting this vulnerability through our HackerOne bug bounty program