BIT-gitlab-2024-9870

vendorUSosv

Unintended Proxy or Intermediary ('Confused Deputy') in GitLab

view advisory published 2025-02-17Licence: per source

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-9870US	high8.8	0.39% (33rd)	—	2025-02-12
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to s…

references

External citations — patches, advisories, analysis.

https://gitlab.com/gitlab-org/gitlab/-/issues/498911EVIDENCE
https://hackerone.com/reports/2734142WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-9870WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan