BIT-gitlab-2024-3976

vendorUSosv

Missing Authorization in GitLab

view advisory published 2025-02-07Licence: per source

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-3976US	—OT elevated	0.62% (50th)	—	2025-02-05
An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11…

references

External citations — patches, advisories, analysis.

https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/ARTICLE
https://gitlab.com/gitlab-org/gitlab/-/issues/457140WEB
https://hackerone.com/reports/2470939WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-3976WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan