CVE-2024-3303

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-3303
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3303.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-3303
Aliases
Downstream
Published
2025-02-13T08:31:11.062Z
Modified
2026-04-10T05:12:18.577313Z
Severity
  • 6.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
Improper Neutralization of Input Used for LLM Prompting in GitLab
Details

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/3xxx/CVE-2024-3303.json",
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-1427"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
280a09dbca836a6eedf5da1e63953fe8da44bf4c
Fixed
53bac28a6c50e5c1efa8b8d2520b24f32993682f
Database specific 
{
    "versions": [
        {
            "introduced": "16.0"
        },
        {
            "fixed": "17.6.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1fd574ee5710155adf5307fba45132264dcb64a1
Fixed
fd7fac14bde2a6aede8d3d68558c4761364e13df
Database specific 
{
    "versions": [
        {
            "introduced": "17.7"
        },
        {
            "fixed": "17.7.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
290b47ded8be87247276edd4d9117662c70366c3
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.2"
        }
    ]
}

Affected versions

v17.*
v17.7.0-ee
v17.7.2-ee
v17.8.0-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-3303.json"