CVE-2024-8974

Description

Information disclosure in Gitlab EE/CE affecting all versions from 15.6 prior to 17.2.8, 17.3 prior to 17.3.4, and 17.4 prior to 17.4.1 in specific conditions it was possible to disclose to an unauthorised user the path of a private project."

Reserved 2024-09-18 | Published 2024-09-26 | Updated 2024-09-27 | Assigner GitLab

Problem types

CWE-684: Incorrect Provision of Specified Functionality

Product status

Default status
unaffected

15.6 before 17.2.8
affected

17.3 before 17.3.4
affected

17.4 before 17.4.1
affected

Credits

This vulnerability has been discovered internally by GitLab team member [Lukas Eipert](https://gitlab.com/leipert) finder

References

gitlab.com/gitlab-org/gitlab/-/issues/482843 (GitLab Issue #482843) issue-tracking permissions-required

cve.org (CVE-2024-8974)

nvd.nist.gov (CVE-2024-8974)

Download JSON