CVE-2024-4278: Incorrect Synchronization in GitLab
An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting via a POST request. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5). It is now mitigated in the latest release and is assigned CVE-2024-4278.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 17.2.8Fixed in 17.3.4Fixed in 17.4.1 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 17.2.8 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 17.3.4 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 17.4.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-4278?
CVE-2024-4278 is classified as an information disclosure vulnerability with potentially significant implications for security.
How do I fix CVE-2024-4278?
To fix CVE-2024-4278, upgrade GitLab to versions 17.2.8, 17.3.4, or 17.4.1 or later.
Who is affected by CVE-2024-4278?
CVE-2024-4278 affects all GitLab EE versions from 16.5 to prior to 17.2.8, 17.3 to prior to 17.3.4, and 17.4 to prior to 17.4.1.
What type of data is exposed in CVE-2024-4278?
CVE-2024-4278 allows maintainers to access the Dependency Proxy password due to improper settings handling.
When was CVE-2024-4278 disclosed?
CVE-2024-4278 was disclosed in 2024, highlighting a critical information disclosure issue.