CVE-2024-4994 HIGH

CVE-2024-4994: Cross-Site Request Forgery (CSRF) in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-352 · CSRF
Published June 20, 2025
Last update June 23, 2025
View on NVD All CVEs

CVSS base score

8.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

Key dates

02Disclosure timeline

June 20, 2025 CVE published
June 23, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-12590 YSlider <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting CVE-2023-39923 WordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-44998 WordPress Category Meta Plugin <= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2023-38398 WordPress Taboola Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF) CVE-2025-30522 WordPress Contact Form 7 Material Design plugin <= 1.0.0 - CSRF to Stored XSS vulnerability