5.4

CVE-2024-5528

Exploit

An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.

Verknüpft mit AI von unstrukturierten Daten zu bestehenden CPE der NVD
Diese Information steht angemeldeten Benutzern zur Verfügung.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version < 16.11.6
Gitlab ≫ Gitlab SwEditionenterprise Version < 16.11.6
Gitlab ≫ Gitlab SwEditioncommunity Version >= 17.0.0 < 17.0.4
Gitlab ≫ Gitlab SwEditionenterprise Version >= 17.0.0 < 17.0.4
Gitlab ≫ Gitlab SwEditioncommunity Version >= 17.1.0 < 17.1.2
Gitlab ≫ Gitlab SwEditionenterprise Version >= 17.1.0 < 17.1.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.05% 0.164
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
cve@gitlab.com 3.5 2.1 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
CWE-1023 Incomplete Comparison with Missing Factors

The product performs a comparison between entities that must consider multiple factors or characteristics of each entity, but the comparison does not include one or more of these factors.

CWE-697 Incorrect Comparison

The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.