CVE-2024-11931

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-11931
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11931.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-11931
Aliases
Downstream
Related
Published
2025-01-24T03:02:16.074Z
Modified
2026-04-10T05:08:22.261459Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Insufficient Granularity of Access Control in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11931.json",
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-1220"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
8c75d0bf4a4190d94326f1a854d0a102ceca4392
Fixed
895b46185b5908d7ac6ca2bfb578950b3c31a572
Database specific 
{
    "versions": [
        {
            "introduced": "17.0"
        },
        {
            "fixed": "17.6.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1fd574ee5710155adf5307fba45132264dcb64a1
Fixed
2aa74e88172ac60f71fd52f9bbf525f5dfab4a9a
Database specific 
{
    "versions": [
        {
            "introduced": "17.7"
        },
        {
            "fixed": "17.7.3"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
a303ad659b5ac357f7fc47e48d10f1827db340ac
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.1"
        }
    ]
}

Affected versions

v17.*
v17.7.0-ee
v17.7.2-ee
v17.8.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-11931.json"