CVE-2024-8977 HIGH

CVE-2024-8977: Server-Side Request Forgery (SSRF) in GitLab

Vendor Gitlab
Product GitLab
Weakness CWE-918 · SSRF
Published October 10, 2024
Last update October 10, 2024
View on NVD All CVEs

CVSS base score

8.2/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

What the vulnerability does

01Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

Key dates

02Disclosure timeline

October 10, 2024 CVE published
October 10, 2024 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-3478 Content Syndication Toolkit <= 1.3 - Unauthenticated Server-Side Request Forgery via 'url' Parameter CVE-2024-27098 Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI CVE-2026-42404 Apache Neethi: Unrestricted HTTP Redirect Following in Policy References CVE-2026-40114 PraisonAI has Server-Side Request Forgery via Unvalidated webhook_url in Jobs API CVE-2026-31974 Blind SSRF on OpenProject instance via webhooks