Unrated severityNVD Advisory· Published Sep 26, 2024· Updated Sep 27, 2024
Improper Encoding or Escaping of Output in GitLab
CVE-2024-4099
Description
An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.0
- (no CPE)range: >=16.0, <17.2.8; >=17.3, <17.3.4; >=17.4, <17.4.1
Patches
Vulnerability mechanics
References
2- hackerone.com/reports/2459597mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/457798mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 17.4.1, 17.3.4, 17.2.8GitLab Security Releases · Sep 25, 2024