CVE-2024-5067 MEDIUM

CVE-2024-5067: Exposure of Sensitive Information to an Unauthorized Actor in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-200 · Info exposure
Published July 24, 2024
Last update August 29, 2024
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.

Key dates

02Disclosure timeline

July 24, 2024 CVE published
August 29, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-42505 Apache Superset: Sensitive information disclosure on db connection details CVE-2024-0242 Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub CVE-2026-47340 Apache DolphinScheduler: An incorrect authorization vulnerability allows authenticated users to access alert instances associated with alert groups they do not have permission to access. CVE-2022-30742 CVE-2026-2476 MS Teams plugin sensitive config values not properly masked in support packets