CVE-2024-5528: Incomplete Comparison with Missing Factors in GitLab
An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages by checking if the domain is enabled every time the custom domain is resolved. This is a low severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N, 3.5). It is now mitigated in the latest release and is assigned CVE-2024-5528.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-5528?
CVE-2024-5528 is rated as a high severity vulnerability due to its potential for subdomain takeover in GitLab Pages.
How do I fix CVE-2024-5528?
To fix CVE-2024-5528, upgrade your GitLab CE or EE to version 16.11.6 or later, or to version 17.0.4 or later for 17.0 series, and to version 17.1.2 or later for 17.1 series.
Which versions are affected by CVE-2024-5528?
CVE-2024-5528 affects GitLab CE and EE versions prior to 16.11.6, and versions from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2.
What type of vulnerability is CVE-2024-5528?
CVE-2024-5528 is a subdomain takeover vulnerability that can be exploited in GitLab Pages.
Who is affected by CVE-2024-5528?
All users of GitLab CE and EE versions prior to the specified patched versions are potentially affected by CVE-2024-5528.