Lucene search

GitLabCVE-2024-4472

HistorySep 12, 2024 - 7:15 p.m.

CVE-2024-4472

2024-09-1219:15:04

CWE-532

GitLab

web.nvd.nist.gov

145

gitlab

ce/ee

vulnerability

retaining

proxy

credentials

graphql

logs

cve-2024-4472

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

4.1

Confidence

High

EPSS

Percentile

9.6%

JSON

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 17.1.7, starting from 17.2 prior to 17.2.5, and starting from 17.3 prior to 17.3.2, where dependency proxy credentials are retained in graphql Logs.

Affected configurations

Nvd

Vulners

Node

gitlabgitlabRange16.5.0–17.1.7community

gitlabgitlabRange16.5.0–17.1.7enterprise

gitlabgitlabRange17.2.0–17.2.5community

gitlabgitlabRange17.2.0–17.2.5enterprise

gitlabgitlabRange17.3.0–17.3.2community

gitlabgitlabRange17.3.0–17.3.2enterprise

VendorProductVersionCPE
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
gitlabgitlab*cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Vendor	Product	Version	CPE
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::community:::*
gitlab	gitlab	*	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "repo": "git://[email protected]:gitlab-org/gitlab.git",
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "versions": [
      {
        "version": "16.5",
        "status": "affected",
        "lessThan": "17.1.7",
        "versionType": "semver"
      },
      {
        "version": "17.3",
        "status": "affected",
        "lessThan": "17.3.2",
        "versionType": "semver"
      },
      {
        "version": "17.2",
        "status": "affected",
        "lessThan": "17.2.5",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]