Lucene search

K

[email protected]NVD:CVE-2024-1816

HistoryJun 27, 2024 - 12:15 a.m.

CVE-2024-1816

2024-06-2700:15:10

CWE-400

[email protected]

web.nvd.nist.gov

4

gitlab

denial of service

openapi

cve-2024-1816

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

12.9%

An issue was discovered in GitLab CE/EE affecting all versions starting from 12.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows for an attacker to cause a denial of service using a crafted OpenAPI file.

Affected configurations

NVD

Node

gitlabgitlabRange12.0–16.11.5community

OR

gitlabgitlabRange12.0–16.11.5enterprise

OR

gitlabgitlabRange17.0.0–17.0.3community

OR

gitlabgitlabRange17.0.0–17.0.3enterprise

OR

gitlabgitlabMatch17.1.0community

OR

gitlabgitlabMatch17.1.0enterprise

References

gitlab.com/gitlab-org/gitlab/-/issues/442852

hackerone.com/reports/2370737

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

0.0004 Low

EPSS

Percentile

12.9%

Related for NVD:CVE-2024-1816

osv1 cvelist1 nessus2 debiancve1 cve1 freebsd1