CVE-2024-9870

MEDIUM

Gitlab < 17.6.5 - SSRF

Title source: rule

Description

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.

References (2)

[Exploit, Issue Tracking] https://gitlab.com/gitlab-org/gitlab/-/issues/498911

[Permissions Required] https://hackerone.com/reports/2734142

Scores

CVSS v3 4.3

EPSS 0.0004

EPSS Percentile 13.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Classification

CWE

CWE-441 CWE-918

Status published

Affected Products (1)

gitlab/gitlab < 17.6.5

Timeline

Published Feb 12, 2025

Tracked Since Feb 18, 2026