Unrated severityNVD Advisory· Published Sep 12, 2024· Updated Sep 13, 2024
Server-Side Request Forgery (SSRF) in GitLab
CVE-2024-8635
Description
A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 16.8
- (no CPE)range: >=16.8, <17.1.7; >=17.2, <17.2.5; >=17.3, <17.3.2
Patches
Vulnerability mechanics
References
1- gitlab.com/gitlab-org/gitlab/-/issues/455273mitreissue-trackingpermissions-required
News mentions
1- GitLab Critical Patch Release: 17.3.2, 17.2.5, 17.1.7GitLab Security Releases · Sep 11, 2024