BIT-gitlab-2024-5435

vendorUSosv

Generation of Error Message Containing Sensitive Information in GitLab

view advisory published 2024-09-14Licence: per source

An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-5435US	medium6.5	0.46% (39th)	—	2024-09-12
An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starti…

references

External citations — patches, advisories, analysis.

https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/WEB
https://gitlab.com/gitlab-org/gitlab/-/issues/464044WEB
https://hackerone.com/reports/2520722WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-5435WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan