CVE-2024-7404

Published: Nov 14, 2024Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.

Affected (6)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 17.2.0 to 17.3.7
Gitlab Gitlab	From 17.4.0 to 17.4.4
Gitlab Gitlab	From 17.5.0 to 17.5.2
Gitlab Gitlab	From 17.2.0 to 17.3.7
Gitlab Gitlab	From 17.4.0 to 17.4.4
Gitlab Gitlab	From 17.5.0 to 17.5.2

Related CWEs

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

References (3)

https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery

Source: cve@gitlab.com

Vendor Advisory

https://gitlab.com/gitlab-org/gitlab/-/issues/476670

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/2627925

Source: cve@gitlab.com

Permissions Required

Timeline

No history available yet.