← Back

CVE-2024-4278

nvd nist
Published: Sep 26, 2024Modified: Jun 17, 2026

JSON object

Loading...
2.7
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Exploitability: 1.2 / Impact: 1.4
Source: NVD

Description

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

Affected (3)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.5.0 to 17.2.8
Gitlab
From 17.3.0 to 17.3.4
Gitlab
Version 17.4.0

Related CWEs

CWE-821
Incorrect Synchronization
The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.

References (2)

Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.