CVE-2024-8977CWE-918

Server-Side Request Forgery (SSRF) in GitLab

High · published October 10, 2024

CVSS v3.1
8.2
EPSS
1%
Percentile
45.3
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

The record
Technical detail
CVSS v3.1
8.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00552 · 45.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2024-10-10T10:02Z
EPSS history
Timeline
  • 10 OCT 10:02Z
    Server-Side Request Forgery (SSRF) in GitLab
    cvelistv5