PT-2024-8870 · Gitlab · Gitlab Ce/Ee+1

Patrick Bajao · Published 2024-11-13 · Updated 2024-12-13 · CVE-2024-10240

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.3 through 17.3.7 GitLab EE versions 17.4 through 17.4.4 GitLab EE versions 17.5 through 17.5.2 GitLab CE versions 17.3 through 17.3.7 GitLab CE versions 17.4 through 17.4.4 GitLab CE versions 17.5 through 17.5.2

Description: The issue is related to the disclosure of system data to unauthorized users in a controlled area. An unauthenticated user may be able to read some information about a merge request in a private project under certain circumstances. Improper output encoding could lead to XSS if Content Security Policy is not enabled.

Recommendations: For GitLab EE versions 17.3 through 17.3.7, update to version 17.3.7 or later. For GitLab EE versions 17.4 through 17.4.4, update to version 17.4.4 or later. For GitLab EE versions 17.5 through 17.5.2, update to version 17.5.2 or later. For GitLab CE versions 17.3 through 17.3.7, update to version 17.3.7 or later. For GitLab CE versions 17.4 through 17.4.4, update to version 17.4.4 or later. For GitLab CE versions 17.5 through 17.5.2, update to version 17.5.2 or later. As a temporary workaround, consider enabling Content Security Policy to minimize the risk of XSS exploitation.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

BDU:2024-10537

BIT-GITLAB-2024-10240

CVE-2024-10240

Affected Products

Gitlab

Gitlab Ce/Ee

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10240.json · Exploit
• https://ubuntu.com/security/CVE-2024-10240 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10240 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-10240 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-10240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10240 · Security Note
• https://bdu.fstec.ru/vul/2024-10537 · Security Note
• https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#information-disclosure-through-an-api-endpoint · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-10240 · Vendor Advisory
• https://t.me/cvenotify/104123 · Telegram Post
• https://twitter.com/CVEnew/status/1861504244270145946 · Twitter Post
• https://vulners.com/cvelist/CVELIST:CVE-2024-10240 · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/493188 · Note