7.5

CVE-2024-9633

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.

Data is provided by the National Vulnerability Database (NVD)
Gitlab ≫ Gitlab SwEditioncommunity Version >= 16.3.0 < 17.4.2
Gitlab ≫ Gitlab SwEditionenterprise Version >= 16.3.0 < 17.4.2
Gitlab ≫ Gitlab SwEditioncommunity Version >= 17.5.0 < 17.5.4
Gitlab ≫ Gitlab SwEditionenterprise Version >= 17.5.0 < 17.5.4
Gitlab ≫ Gitlab SwEditioncommunity Version >= 17.6.0 < 17.6.2
Gitlab ≫ Gitlab SwEditionenterprise Version >= 17.6.0 < 17.6.2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.02% 0.039
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve@gitlab.com 3.1 1.6 1.4
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L
CWE-708 Incorrect Ownership Assignment

The product assigns an owner to a resource, but the owner is outside of the intended control sphere.