CVE-2024-8977 - Server-Side Request Forgery (SSRF) in GitLab

Back Back to CVE browser

HIGH

Server-Side Request Forgery (SSRF) in GitLab

Published Oct 10, 2024

8.2

HIGH

CVSS 3.1

EPSS 0.55%

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  15.10
  Status
  affected
  Constraints
  <17.2.9
- Version
  17.3
  Status
  affected
  Constraints
  <17.3.5
- Version
  17.4
  Status
  affected
  Constraints
  <17.4.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
15.10	affected	<17.2.9
17.3	affected	<17.3.5
17.4	affected	<17.4.2

Remediation

Vendor solution

Upgrade to versions 17.2.9, 17.3.5, 17.4.2 or above.

Weaknesses (1)

CWE-918

SSRF

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49517
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/491060
issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2697456
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-49517		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/491060		issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2697456		technical-descriptionexploitpermissions-requiredPermissions Required