CVE-2024-7404: Improper Restriction of Rendered UI Layers or Frames in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-7404?
CVE-2024-7404 is rated as a critical vulnerability due to its potential to allow attackers full API access through the Device OAuth flow.
How do I fix CVE-2024-7404?
To mitigate CVE-2024-7404, upgrade GitLab CE/EE to version 17.3.7, 17.4.4, or 17.5.2 or later.
What versions are affected by CVE-2024-7404?
CVE-2024-7404 affects GitLab versions starting from 17.2 to prior 17.3.7, 17.4 to prior 17.4.4, and 17.5 to prior 17.5.2.
What does CVE-2024-7404 allow an attacker to do?
CVE-2024-7404 allows an attacker to gain full API access as the victim via the Device OAuth flow.
Is CVE-2024-7404 present in both GitLab CE and EE?
Yes, CVE-2024-7404 affects both GitLab Community Edition (CE) and Enterprise Edition (EE) for the specified versions.