CVE-2024-2743: Incorrect Authorization in GitLab
An issue was discovered in GitLab EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-2743.
Other sources
An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.
— MITRE
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2743?
CVE-2024-2743 is considered a high severity vulnerability that allows unauthorized modification of DAST scans.
How do I fix CVE-2024-2743?
To fix CVE-2024-2743, upgrade GitLab to version 17.1.7 or later, 17.2.5 or later, or 17.3.2 or later.
What types of attacks are possible with CVE-2024-2743?
CVE-2024-2743 allows an attacker to modify on-demand DAST scans and potentially leak sensitive variables.
Which versions of GitLab are affected by CVE-2024-2743?
CVE-2024-2743 affects GitLab-EE versions from 13.3 up to 17.1.7, 17.2 up to 17.2.5, and 17.3 up to 17.3.2.
Is CVE-2024-2743 present in community editions of GitLab?
CVE-2024-2743 specifically affects GitLab Enterprise Edition (EE) and does not apply to community editions.