CVE-2024-7404: Improper Restriction of Rendered UI Layers or Frames in GitLab
First published: Thu Nov 14 2024(Updated: )
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=17.2.0<17.3.7 | |
| GitLab | >=17.2.0<17.3.7 | |
| GitLab | >=17.4.0<17.4.4 | |
| GitLab | >=17.4.0<17.4.4 | |
| GitLab | >=17.5.0<17.5.2 | |
| GitLab | >=17.5.0<17.5.2 |
Remedy
Upgrade to versions 17.5.2, 17.4.4, 17.3.7 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7404?
CVE-2024-7404 is rated as a critical vulnerability due to its potential to allow attackers full API access through the Device OAuth flow.
How do I fix CVE-2024-7404?
To mitigate CVE-2024-7404, upgrade GitLab CE/EE to version 17.3.7, 17.4.4, or 17.5.2 or later.
What versions are affected by CVE-2024-7404?
CVE-2024-7404 affects GitLab versions starting from 17.2 to prior 17.3.7, 17.4 to prior 17.4.4, and 17.5 to prior 17.5.2.
What does CVE-2024-7404 allow an attacker to do?
CVE-2024-7404 allows an attacker to gain full API access as the victim via the Device OAuth flow.
Is CVE-2024-7404 present in both GitLab CE and EE?
Yes, CVE-2024-7404 affects both GitLab Community Edition (CE) and Enterprise Edition (EE) for the specified versions.
- agent/title
- agent/remedy
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/17.2.0
- version/gitlab/17.4.0
- version/gitlab/17.5.0