PT-2025-15979 · Gitlab · Gitlab Ce/Ee

Published 2025-04-09 · Updated 2025-08-07 · CVE-2024-11129

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 17.1 through 17.8.6 GitLab EE versions 17.9 through 17.9.5 GitLab EE versions 17.10 through 17.10.3

Description: An issue has been discovered in GitLab EE that allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term.

Recommendations: For versions 17.1 through 17.8.6, update to version 17.8.7 or later. For versions 17.9 through 17.9.5, update to version 17.9.6 or later. For versions 17.10 through 17.10.3, update to version 17.10.4 or later.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2025-04559

BIT-GITLAB-2024-11129

CVE-2024-11129

Affected Products

Gitlab Ce/Ee

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11129.json · Exploit
• 🔥 https://hackerone.com/reports/2717400 · Exploit
• https://osv.dev/vulnerability/CVE-2024-11129 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2024-11129 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-11129 · Security Note
• https://bdu.fstec.ru/vul/2025-04559 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/503722 · Note
• https://t.me/cvedetector/22670 · Telegram Post
• https://twitter.com/CVEnew/status/1910335833812676838 · Twitter Post
• https://about.gitlab.com/releases/2025/04/09/patch-release-gitlab-17-10-4-released · Note
• https://t.me/cvetracker/21322 · Telegram Post
• https://t.me/cveNotify/131323 · Telegram Post