CVE-2024-8977

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1

8.2 HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS

0.55% chance of exploitation in the next 30 days, 44th percentile

Published

2024-10-10

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2697456

References

• CVE Record
• NVD entry

Related

• CVE-2024-8973
• CVE-2024-8983
• CVE-2024-8970
• CVE-2024-9001
• CVE-2024-8968
• CVE-2024-9003