CVE-2024-3976: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to…

Medium severity · published Feb 5, 2025

CVE-2024-3976

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to…

6.5

CVSS

0.6%

EPSS

On KEV

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose via the UI the confidential issues title and description from a public project to unauthorised instance users.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.6% · higher than 50% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

GitLab · GitLab

14.0.0 before 16.9.7; 14.0.0 before 16.9.7; 16.10.0 before 16.10.5; 16.10.0 before 16.10.5; 16.11.0 before 16.11.2; 16.11.0 before 16.11.2 · source: NVD

Affected product

GitLab

All GitLab CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-3976

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-3976

Broken Link

https://gitlab.com/gitlab-org/gitlab/-/issues/457140

Permissions Required

https://hackerone.com/reports/2470939

Release Notes

https://about.gitlab.com/releases/2024/05/08/patch-release-gitlab-16-11-2-released/