CVE-2024-12431

Missing Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.

Affected

GitLab

CVSS v3.1 GITLAB

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

EPSS

0.44% chance of exploitation in the next 30 days, 37th percentile

Published

2025-01-08

Updated

2025-02-12

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2877710

Security advisories

• https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauth…
• https://gitlab.com/gitlab-org/gitlab/-/issues/508742

References

• CVE Record
• NVD entry