CVE-2024-4994

Published: Jun 20, 2025Modified: Aug 12, 2025

8.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 2.8 / Impact: 5.2

Source: cve@gitlab.com (Secondary)

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 16.1.0 to 16.11.5
Gitlab Gitlab	From 17.0.0 to 17.0.3
Gitlab Gitlab	From 16.1.0 to 16.11.5
Gitlab Gitlab	From 17.0.0 to 17.0.3
Gitlab Gitlab	Version 17.1.0
Gitlab Gitlab	Version 17.1.0

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (2)

https://gitlab.com/gitlab-org/gitlab/-/issues/462012

Source: cve@gitlab.com

ExploitIssue Tracking

https://hackerone.com/reports/2473644

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.