CVE-2024-8635CWE-918

Server-Side Request Forgery (SSRF) in GitLab

High · published September 12, 2024

CVSS v3.1
7.7
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.6th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-09-12T17:01Z
EPSS history
Timeline
  • 12 SEP 17:01Z
    Server-Side Request Forgery (SSRF) in GitLab
    cvelistv5