Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2024-3115: GitLab can expose issues and epics to unauthorized users
CVE-2024-3115 · published 2 years ago
Summary
In certain GitLab versions, a flaw lets someone view internal issue and epic details without logging in through single sign‑on. This could reveal confidential project information to outsiders. Apply the latest GitLab update that fixes the problem as soon as possible.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 16.0.0, < 16.11.5 >= 17.0.0, < 17.0.3 17.1.0 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Exposure of Sensitive Information to an Unauthorized Actor in GitLab
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3115.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-3115 Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/452548 Third Party Advisory
- https://hackerone.com/reports/2417868 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published26 Jun 2024
Updated4 Nov 2026
First seen22 Aug 2026
Track software like this
Free during beta