« Volver al listado

CVE-2024-8116

Estado: AnalizadaMedia (5.3)—

An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitlab — Gitlab

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8116",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8116",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-12-16T16:44:39.431414Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@gitlab.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@gitlab.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
          ],
          "repo": "git://git@gitlab.com:gitlab-org/gitlab.git",
          "vendor": "GitLab",
          "product": "GitLab",
          "versions": [
            {
              "status": "affected",
              "version": "16.9",
              "lessThan": "17.4.6",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "17.5",
              "lessThan": "17.5.4",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "17.6",
              "lessThan": "17.6.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-12-16T05:15:05.520",
  "references": [
    {
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/480509",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "cve@gitlab.com"
    },
    {
      "url": "https://hackerone.com/reports/2666216",
      "tags": [
        "Permissions Required"
      ],
      "source": "cve@gitlab.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@gitlab.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue has been discovered in GitLab CE/EE affecting all versions from 16.9 before 17.4.6, 17.5 before 17.5.4, and 17.6 before 17.6.2. By using a specific GraphQL query, under specific conditions an unauthorized user can retrieve branch names."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones desde la 16.9 hasta la 17.4.6, desde la 17.5 hasta la 17.5.4 y desde la 17.6 hasta la 17.6.2. Al usar una consulta GraphQL específica, en determinadas condiciones, un usuario no autorizado puede recuperar nombres de ramas."
    }
  ],
  "lastModified": "2026-06-17T08:21:55.270",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8B70F5D0-3E6A-4C28-8614-EBCFFB8BE325",
              "versionEndExcluding": "17.4.6",
              "versionStartIncluding": "16.9.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D1B4FB6C-6AF9-4259-B363-C439F8AFD8DB",
              "versionEndExcluding": "17.4.6",
              "versionStartIncluding": "16.9.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1587202E-2392-46F3-BE79-00BE065AD2AE",
              "versionEndExcluding": "17.5.4",
              "versionStartIncluding": "17.5.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0A13BB0D-E1E4-4C0B-A823-E661591D4E4F",
              "versionEndExcluding": "17.5.4",
              "versionStartIncluding": "17.5.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E994AE4-0E47-4CF0-93B2-C28A5E274059",
              "versionEndExcluding": "17.6.2",
              "versionStartIncluding": "17.6.0"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "01C8A373-615F-45FE-8AF7-BB053EC77D82",
              "versionEndExcluding": "17.6.2",
              "versionStartIncluding": "17.6.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@gitlab.com"
}