CVE-2024-5435

MEDIUM

GitLab 15.10.0-17.1.6, 17.2.0-17.2.4, 17.3.0-17.3.1 - Sensitive Information Disclosure

Title source: llm

Description

An issue has been discovered discovered in GitLab EE/CE affecting all versions starting from 15.10 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2 will disclose user password from repository mirror configuration.

References (3)

Core 3

Core References

Release Notes

https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released/

Broken Link issue-tracking permissions-required

https://gitlab.com/gitlab-org/gitlab/-/issues/464044

Permissions Required technical-description exploit permissions-required

https://hackerone.com/reports/2520722

Scores

CVSS v3 4.5

EPSS 0.0042

EPSS Percentile 33.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-209

Status published

Products (1)

gitlab/gitlab 15.10.0 - 17.1.7 (2 CPE variants)

Published Sep 12, 2024

Tracked Since Feb 18, 2026