CVE-2024-4278: Incorrect Synchronization in GitLab

Q: What is the severity of CVE-2024-4278?

CVE-2024-4278 is classified as an information disclosure vulnerability with potentially significant implications for security.

Q: How do I fix CVE-2024-4278?

To fix CVE-2024-4278, upgrade GitLab to versions 17.2.8, 17.3.4, or 17.4.1 or later.

Q: Who is affected by CVE-2024-4278?

CVE-2024-4278 affects all GitLab EE versions from 16.5 to prior to 17.2.8, 17.3 to prior to 17.3.4, and 17.4 to prior to 17.4.1.

Q: What type of data is exposed in CVE-2024-4278?

CVE-2024-4278 allows maintainers to access the Dependency Proxy password due to improper settings handling.

Q: When was CVE-2024-4278 disclosed?

CVE-2024-4278 was disclosed in 2024, highlighting a critical information disclosure issue.

Published Sep 25, 2024

Updated

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting via a POST request. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N, 5.5). It is now mitigated in the latest release and is assigned CVE-2024-4278.

Affected Software

4 affected componentsFixes available

GitLab GitLab>=16.5.0<17.2.8

GitLab GitLab>=17.3.0<17.3.4

GitLab GitLab=17.4.0

GitLab GitLab EE>=16.5<17.2.8, >=17.3<17.3.4, >=17.4<17.4.1

17.2.817.3.417.4.1

Remediation

Information

Upgrade to versions 17.2.8, 17.3.4, 17.4.1 or above.

Event History

Sep 26, 2024

CVE Published

via MITRE·06:30 AM

Data Sourced

via MITRE·06:30 AM

RemedyDescriptionSeverityWeakness

Apr 22, 2026

Data Sourced

via GitLab·08:55 AM

DescriptionSeverityAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-4278?