Unrated severityNVD Advisory· Published Dec 12, 2024· Updated Dec 12, 2024
Incorrect Authorization in GitLab
CVE-2024-10043
Description
An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 14.3
- (no CPE)range: >=14.3 <17.4.6 || >=17.5 <17.5.4 || >=17.6 <17.6.2
Patches
Vulnerability mechanics
References
2- hackerone.com/reports/2774817mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/499577mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 17.6.2, 17.5.4, 17.4.6GitLab Security Releases · Dec 11, 2024