Unrated severityNVD Advisory· Published Jun 20, 2025· Updated Jun 20, 2025
Insertion of Sensitive Information into Log File in GitLab
CVE-2024-7586
Description
An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 17.0
- (no CPE)range: >=17.0 <17.0.6, >=17.1 <17.1.4, >=17.2 <17.2.2
Patches
Vulnerability mechanics
References
1- gitlab.com/gitlab-org/gitlab/-/issues/463866mitreissue-trackingpermissions-required
News mentions
1- GitLab Patch Release: 17.2.2, 17.1.4, 17.0.6GitLab Security Releases · Aug 7, 2024