CVE-2024-11129: Generation of Error Message Containing Sensitive Information in GitLab
An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."
Other sources
An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4, This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term. This is a medium severity issue (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-11129
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-11129?
CVE-2024-11129 is categorized as a serious vulnerability due to its ability to expose sensitive information through targeted searches.
How do I fix CVE-2024-11129?
To mitigate CVE-2024-11129, upgrade GitLab EE to version 17.8.7, 17.9.6, or 17.10.4 or later.
What versions of GitLab EE are affected by CVE-2024-11129?
CVE-2024-11129 affects GitLab EE versions 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4.
What type of attack does CVE-2024-11129 enable?
CVE-2024-11129 allows attackers to perform targeted keyword searches that reveal the count of issues associated with that term.
Is user data at risk due to CVE-2024-11129?
Yes, user data may be at risk as attackers can extract information about issue counts based on sensitive keywords.