CVE-2024-12292

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.

CVSS v3 4.0 MEDIUM

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/475211	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

11 Jul 2025, 20:33

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/475211 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/475211 - Broken Link
CPE		cpe:2.3:a:gitlab:gitlab:::::community:::* cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
Summary		(es) Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.0 anterior a la 17.4.6, desde la 17.5 anterior a la 17.5.4 y desde la 17.6 anterior a la 17.6.2, donde la información confidencial pasada en mutaciones de GraphQL podría haberse conservado en los registros de GraphQL.
First Time		Gitlab Gitlab gitlab

12 Dec 2024, 12:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-12 12:15

Updated : 2025-07-11 20:33

NVD link : CVE-2024-12292

Mitre link : CVE-2024-12292

CVE.ORG link : CVE-2024-12292

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2024-12292", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.5}]}, "published": "2024-12-12T12:15:22.470", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/475211", "tags": ["Broken Link"], "source": "cve@gitlab.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde la 11.0 anterior a la 17.4.6, desde la 17.5 anterior a la 17.5.4 y desde la 17.6 anterior a la 17.6.2, donde la informaci\u00f3n confidencial pasada en mutaciones de GraphQL podr\u00eda haberse conservado en los registros de GraphQL."}], "lastModified": "2025-07-11T20:33:11.343", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "099809DD-847E-4CAE-9A62-6E22892185B8", "versionEndExcluding": "17.4.6", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2394D340-C29D-4D67-A54E-CC6060AF2ECF", "versionEndExcluding": "17.4.6", "versionStartIncluding": "11.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "1587202E-2392-46F3-BE79-00BE065AD2AE", "versionEndExcluding": "17.5.4", "versionStartIncluding": "17.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "0A13BB0D-E1E4-4C0B-A823-E661591D4E4F", "versionEndExcluding": "17.5.4", "versionStartIncluding": "17.5.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "1E994AE4-0E47-4CF0-93B2-C28A5E274059", "versionEndExcluding": "17.6.2", "versionStartIncluding": "17.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "01C8A373-615F-45FE-8AF7-BB053EC77D82", "versionEndExcluding": "17.6.2", "versionStartIncluding": "17.6.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}