CVE-2024-11129

MEDIUM

GitLab 17.1-17.8.6 17.9-17.9.5 17.10-17.10.3 - Information Disclosure via Issue Search

Title source: llm
STIX 2.1

Description

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."

References (2)

Core 2
Core References
Broken Link issue-tracking permissions-required
https://gitlab.com/gitlab-org/gitlab/-/issues/503722
Permissions Required technical-description exploit permissions-required
https://hackerone.com/reports/2717400

Scores

CVSS v3 6.3
EPSS 0.0030
EPSS Percentile 21.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-209
Status published
Products (2)
gitlab/gitlab 17.1.0 - 17.8.6
gitlab/gitlab 17.1.0 - 17.8.7
Published Apr 10, 2025
Tracked Since Feb 18, 2026