CVE-2024-8635 HIGH

CVE-2024-8635: Server-Side Request Forgery (SSRF) in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-918 · SSRF
Published September 12, 2024
Last update September 13, 2024
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL

Key dates

02Disclosure timeline

September 12, 2024 CVE published
September 13, 2024 Record updated