CVE-2024-10043

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.

CVSS v3 3.1 LOW

3.1^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/499577	Exploit Issue Tracking Vendor Advisory
https://hackerone.com/reports/2774817	Permissions Required

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

11 Jul 2025, 20:33

Type	Values Removed	Values Added
Summary		(es) Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 14.3 hasta la 17.4.6, todas las versiones desde la 17.5 hasta la 17.5.4 y todas las versiones desde la 17.6 hasta la 17.6.2, que permite a los usuarios del grupo ver el título del incidente confidencial a través de la función Wiki History Diff, lo que podría llevar a la divulgación de información.
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/499577 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/499577 - Exploit, Issue Tracking, Vendor Advisory
References	~~() https://hackerone.com/reports/2774817 -~~	() https://hackerone.com/reports/2774817 - Permissions Required
CPE		cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
First Time		Gitlab Gitlab gitlab

12 Dec 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-12 12:15

Updated : 2025-07-11 20:33

NVD link : CVE-2024-10043

Mitre link : CVE-2024-10043

CVE.ORG link : CVE-2024-10043

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-10043", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2024-12-12T12:15:21.330", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/499577", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2774817", "tags": ["Permissions Required"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure."}, {"lang": "es", "value": "Se ha descubierto un problema en GitLab EE que afecta a todas las versiones desde la 14.3 hasta la 17.4.6, todas las versiones desde la 17.5 hasta la 17.5.4 y todas las versiones desde la 17.6 hasta la 17.6.2, que permite a los usuarios del grupo ver el t\u00edtulo del incidente confidencial a trav\u00e9s de la funci\u00f3n Wiki History Diff, lo que podr\u00eda llevar a la divulgaci\u00f3n de informaci\u00f3n."}], "lastModified": "2025-07-11T20:33:50.760", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "097BF70E-BBBB-463D-B272-9DF088FFF7D8", "versionEndExcluding": "17.4.6", "versionStartIncluding": "14.3.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0A13BB0D-E1E4-4C0B-A823-E661591D4E4F", "versionEndExcluding": "17.5.4", "versionStartIncluding": "17.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "01C8A373-615F-45FE-8AF7-BB053EC77D82", "versionEndExcluding": "17.6.2", "versionStartIncluding": "17.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}