CVE-2024-8974 (GCVE-0-2024-8974)

Vulnerability from cvelistv5 – Published: 2024-09-26 23:02 – Updated: 2024-09-27 15:46
VLAI?
Summary
Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."
Severity ?
2.6 (Low)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE
  • CWE-684 - Incorrect Provision of Specified Functionality
Assigner
References
https://gitlab.com/gitlab-org/gitlab/-/issues/482843 issue-trackingpermissions-required
Impacted products
Vendor Product Version
GitLab GitLab Affected: 15.6 , < 17.2.8 (semver)
Affected: 17.3 , < 17.3.4 (semver)
Affected: 17.4 , < 17.4.1 (semver)
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
 Create a notification for this product.
Credits
This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert)
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-8974",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-27T15:46:36.689310Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-27T15:46:48.041Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "GitLab",
          "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
          "vendor": "GitLab",
          "versions": [
            {
              "lessThan": "17.2.8",
              "status": "affected",
              "version": "15.6",
              "versionType": "semver"
            },
            {
              "lessThan": "17.3.4",
              "status": "affected",
              "version": "17.3",
              "versionType": "semver"
            },
            {
              "lessThan": "17.4.1",
              "status": "affected",
              "version": "17.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\""
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 2.6,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-684",
              "description": "CWE-684: Incorrect Provision of Specified Functionality",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-09-26T23:02:00.153Z",
        "orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
        "shortName": "GitLab"
      },
      "references": [
        {
          "name": "GitLab Issue #482843",
          "tags": [
            "issue-tracking",
            "permissions-required"
          ],
          "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/482843"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to version 17.4.1, 17.3.4, 17.2.8."
        }
      ],
      "title": "Incorrect Provision of Specified Functionality in GitLab"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a",
    "assignerShortName": "GitLab",
    "cveId": "CVE-2024-8974",
    "datePublished": "2024-09-26T23:02:00.153Z",
    "dateReserved": "2024-09-18T14:01:58.766Z",
    "dateUpdated": "2024-09-27T15:46:48.041Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\", \"versionStartIncluding\": \"15.6.0\", \"versionEndExcluding\": \"17.2.8\", \"matchCriteriaId\": \"CF1537ED-2DE1-4781-ABD4-64816E5CE8D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"15.6.0\", \"versionEndExcluding\": \"17.2.8\", \"matchCriteriaId\": \"84ADBC3D-7A98-453A-8F34-FF810842EDCA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\", \"versionStartIncluding\": \"17.3.0\", \"versionEndExcluding\": \"17.3.4\", \"matchCriteriaId\": \"FBB47BC0-FE38-4628-B4C2-DA89EC467CF8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\", \"versionStartIncluding\": \"17.3.0\", \"versionEndExcluding\": \"17.3.4\", \"matchCriteriaId\": \"27CB6247-D7EE-40BB-BF4A-8CE5350E31BF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*\", \"matchCriteriaId\": \"4FEBC1F7-0AAA-4CA2-B099-3F4218900FB3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*\", \"matchCriteriaId\": \"3AC3130C-A3AA-403A-85D9-92FD2B8BC091\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\\\"\"}, {\"lang\": \"es\", \"value\": \"Divulgaci\\u00f3n de informaci\\u00f3n en Gitlab EE/CE que afecta a todas las versiones desde la 15.6 anterior a la 17.2.8, la 17.3 anterior a la 17.3.4 y la 17.4 anterior a la 17.4.1: en condiciones espec\\u00edficas era posible revelar a un usuario no autorizado la ruta de un proyecto privado.\"}]",
      "id": "CVE-2024-8974",
      "lastModified": "2024-10-04T17:30:18.803",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cve@gitlab.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N\", \"baseScore\": 2.6, \"baseSeverity\": \"LOW\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.2, \"impactScore\": 1.4}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\", \"baseScore\": 4.3, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 1.4}]}",
      "published": "2024-09-26T23:15:03.083",
      "references": "[{\"url\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/482843\", \"source\": \"cve@gitlab.com\", \"tags\": [\"Broken Link\"]}]",
      "sourceIdentifier": "cve@gitlab.com",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"cve@gitlab.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-684\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-863\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-8974\",\"sourceIdentifier\":\"cve@gitlab.com\",\"published\":\"2024-09-26T23:15:03.083\",\"lastModified\":\"2024-10-04T17:30:18.803\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\\\"\"},{\"lang\":\"es\",\"value\":\"Divulgaci\u00f3n de informaci\u00f3n en Gitlab EE/CE que afecta a todas las versiones desde la 15.6 anterior a la 17.2.8, la 17.3 anterior a la 17.3.4 y la 17.4 anterior a la 17.4.1: en condiciones espec\u00edficas era posible revelar a un usuario no autorizado la ruta de un proyecto privado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N\",\"baseScore\":2.6,\"baseSeverity\":\"LOW\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.2,\"impactScore\":1.4},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\",\"baseScore\":4.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":1.4}]},\"weaknesses\":[{\"source\":\"cve@gitlab.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-684\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-863\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"15.6.0\",\"versionEndExcluding\":\"17.2.8\",\"matchCriteriaId\":\"CF1537ED-2DE1-4781-ABD4-64816E5CE8D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"15.6.0\",\"versionEndExcluding\":\"17.2.8\",\"matchCriteriaId\":\"84ADBC3D-7A98-453A-8F34-FF810842EDCA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*\",\"versionStartIncluding\":\"17.3.0\",\"versionEndExcluding\":\"17.3.4\",\"matchCriteriaId\":\"FBB47BC0-FE38-4628-B4C2-DA89EC467CF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*\",\"versionStartIncluding\":\"17.3.0\",\"versionEndExcluding\":\"17.3.4\",\"matchCriteriaId\":\"27CB6247-D7EE-40BB-BF4A-8CE5350E31BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*\",\"matchCriteriaId\":\"4FEBC1F7-0AAA-4CA2-B099-3F4218900FB3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"3AC3130C-A3AA-403A-85D9-92FD2B8BC091\"}]}]}],\"references\":[{\"url\":\"https://gitlab.com/gitlab-org/gitlab/-/issues/482843\",\"source\":\"cve@gitlab.com\",\"tags\":[\"Broken Link\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-8974\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-27T15:46:36.689310Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-27T15:46:42.955Z\"}}], \"cna\": {\"title\": \"Incorrect Provision of Specified Functionality in GitLab\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert)\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 2.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"LOW\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*\"], \"repo\": \"git://git@gitlab.com:gitlab-org/gitlab.git\", \"vendor\": \"GitLab\", \"product\": \"GitLab\", \"versions\": [{\"status\": \"affected\", \"version\": \"15.6\", \"lessThan\": \"17.2.8\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"17.3\", \"lessThan\": \"17.3.4\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"17.4\", \"lessThan\": \"17.4.1\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to version 17.4.1, 17.3.4, 17.2.8.\"}], \"references\": [{\"url\": \"https://gitlab.com/gitlab-org/gitlab/-/issues/482843\", \"name\": \"GitLab Issue #482843\", \"tags\": [\"issue-tracking\", \"permissions-required\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project.\\\"\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-684\", \"description\": \"CWE-684: Incorrect Provision of Specified Functionality\"}]}], \"providerMetadata\": {\"orgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"shortName\": \"GitLab\", \"dateUpdated\": \"2024-09-26T23:02:00.153Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-8974\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-09-27T15:46:48.041Z\", \"dateReserved\": \"2024-09-18T14:01:58.766Z\", \"assignerOrgId\": \"ceab7361-8a18-47b1-92ba-4d7d25f6715a\", \"datePublished\": \"2024-09-26T23:02:00.153Z\", \"assignerShortName\": \"GitLab\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.