CVE-2024-12244: Missing Authorization in GitLab
An issue has been discovered in access controls could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
Other sources
An issue has been discovered in access controls that could allow users to view certain restricted project information even when related features are disabled in GitLab EE, affecting all versions from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-12244.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-12244?
CVE-2024-12244 has been classified as a high severity vulnerability due to its potential impact on access controls.
How do I fix CVE-2024-12244?
To fix CVE-2024-12244, upgrade GitLab EE to version 17.9.7, 17.10.5, or 17.11.1 or later.
What versions of GitLab EE are affected by CVE-2024-12244?
CVE-2024-12244 affects all versions of GitLab EE from 17.7 prior to 17.9.7, 17.10 prior to 17.10.5, and 17.11 prior to 17.11.1.
What type of issue does CVE-2024-12244 represent?
CVE-2024-12244 represents an issue with access controls that may allow unauthorized users to view restricted project information.
Is CVE-2024-12244 a persistent issue in any future releases of GitLab EE?
No, CVE-2024-12244 has been addressed in the subsequent versions and is not present in versions 17.9.7, 17.10.5, or 17.11.1 onwards.