CVE-2024-5435
Generation of Error Message Containing Sensitive Information in GitLab
- State
- Published
- Severity
- 4.5 Medium
- Published
- Sep 12, 2024
- Updated
- Sep 13, 2024
- Reserved
- May 28, 2024
Description
An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.5 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N | GitLab |
Weaknesses
- CWE-209 Generation of Error Message Containing Sensitive Information
Affected Products
| Product | Versions |
|---|---|
GitLabGitLab |
|
References
- GitLab Issue #464044issue-trackingpermissions-required
- HackerOne Bug Bounty Report #2520722technical-descriptionexploitpermissions-required
- https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.