CVE-2024-9870

MEDIUM

Gitlab < 17.6.5 - SSRF

Title source: rule
STIX 2.1

Description

An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.

References (2)

Scores

CVSS v3 4.3
EPSS 0.0003
EPSS Percentile 7.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-441 CWE-918
Status published
Products (1)
gitlab/gitlab 15.11.0 - 17.6.5
Published Feb 12, 2025
Tracked Since Feb 18, 2026