4.3

CVE-2024-8974

Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

Data is provided by the National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version >= 15.6.0 < 17.2.8
Gitlab ≫ Gitlab SwEditionenterprise Version >= 15.6.0 < 17.2.8
Gitlab ≫ Gitlab SwEditioncommunity Version >= 17.3.0 < 17.3.4
Gitlab ≫ Gitlab SwEditionenterprise Version >= 17.3.0 < 17.3.4
Gitlab ≫ Gitlab Version17.4.0 SwEditioncommunity
Gitlab ≫ Gitlab Version17.4.0 SwEditionenterprise
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.03% 0.065
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.3 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
cve@gitlab.com 2.6 1.2 1.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N
CWE-684 Incorrect Provision of Specified Functionality

The code does not function according to its published specifications, potentially leading to incorrect usage.

CWE-863 Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.