CVE-2024-9633

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-9633
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.

3.1 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/498257 Broken Link
https://hackerone.com/reports/2759470 Permissions Required
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
History

12 Dec 2024, 21:43

Type Values Removed Values Added
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
References () https://gitlab.com/gitlab-org/gitlab/-/issues/498257 - () https://gitlab.com/gitlab-org/gitlab/-/issues/498257 - Broken Link
References () https://hackerone.com/reports/2759470 - () https://hackerone.com/reports/2759470 - Permissions Required
First Time Gitlab gitlab
Gitlab
CWE NVD-CWE-noinfo

06 Dec 2024, 11:15

Type Values Removed Values Added
Summary (en) An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks. (en) An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.3 before 17.4.2, all versions starting from 17.5 before 17.5.4, all versions starting from 17.6 before 17.6.2. This issue allows an attacker to create a group with a name matching an existing unique Pages domain, potentially leading to domain confusion attacks.

15 Nov 2024, 13:58

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto un problema en GitLab CE/EE que afecta a todas las versiones a partir de la 16.3 hasta la 17.3.7, a todas las versiones a partir de la 17.4 hasta la 17.4.4 y a todas las versiones a partir de la 17.5 hasta la 17.5.2. Este problema permite a un atacante crear un grupo con un nombre que coincida con un dominio de Pages único existente, lo que puede provocar ataques de confusión de dominios.

14 Nov 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-11-14 14:15

Updated : 2024-12-12 21:43

NVD link : CVE-2024-9633

Mitre link : CVE-2024-9633

CVE.ORG link : CVE-2024-9633

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-708

Incorrect Ownership Assignment

NVD-CWE-noinfo