{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5067", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-05-17T13:30:44.660Z", "datePublished": "2024-07-24T22:08:05.034Z", "dateUpdated": "2024-08-29T15:04:59.039Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "17.0.5", "status": "affected", "version": "16.11", "versionType": "semver"}, {"lessThan": "17.1.3", "status": "affected", "version": "17.1", "versionType": "semver"}, {"lessThan": "17.2.1", "status": "affected", "version": "17.2", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Thanks [yvvdwf](https://hackerone.com/yvvdwf) and [zebraman](https://hackerone.com/zebraman) for reporting this vulnerability through our HackerOne bug bounty program"}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:59.039Z"}, "references": [{"name": "GitLab Issue #458504", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504"}, {"name": "GitLab Issue #462427", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427"}, {"name": "HackerOne Bug Bounty Report #2462303", "tags": ["technical-description", "exploit", "permissions-required"], "url": "https://hackerone.com/reports/2462303"}, {"name": "HackerOne Bug Bounty Report #2502047", "tags": ["technical-description", "exploit", "permissions-required"], "url": "https://hackerone.com/reports/2502047"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above."}], "title": "Exposure of Sensitive Information to an Unauthorized Actor in GitLab"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-26T15:32:48.918789Z", "id": "CVE-2024-5067", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-26T15:33:01.159Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:03:10.510Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504", "name": "GitLab Issue #458504", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427", "name": "GitLab Issue #462427", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2462303", "name": "HackerOne Bug Bounty Report #2462303", "tags": ["technical-description", "exploit", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2502047", "name": "HackerOne Bug Bounty Report #2502047", "tags": ["technical-description", "exploit", "permissions-required", "x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504", "name": "GitLab Issue #458504", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427", "name": "GitLab Issue #462427", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2462303", "name": "HackerOne Bug Bounty Report #2462303", "tags": ["technical-description", "exploit", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2502047", "name": "HackerOne Bug Bounty Report #2502047", "tags": ["technical-description", "exploit", "permissions-required", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:03:10.510Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5067", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-26T15:32:48.918789Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-26T15:32:56.736Z"}}], "cna": {"title": "Exposure of Sensitive Information to an Unauthorized Actor in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [yvvdwf](https://hackerone.com/yvvdwf) and [zebraman](https://hackerone.com/zebraman) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "16.11", "lessThan": "17.0.5", "versionType": "semver"}, {"status": "affected", "version": "17.1", "lessThan": "17.1.3", "versionType": "semver"}, {"status": "affected", "version": "17.2", "lessThan": "17.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504", "name": "GitLab Issue #458504", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427", "name": "GitLab Issue #462427", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/2462303", "name": "HackerOne Bug Bounty Report #2462303", "tags": ["technical-description", "exploit", "permissions-required"]}, {"url": "https://hackerone.com/reports/2502047", "name": "HackerOne Bug Bounty Report #2502047", "tags": ["technical-description", "exploit", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-200", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-08-29T15:04:59.039Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5067", "state": "PUBLISHED", "dateUpdated": "2024-08-29T15:04:59.039Z", "dateReserved": "2024-05-17T13:30:44.660Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-07-24T22:08:05.034Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "2BF8BC38-C7F7-4123-A27A-0E77FBC9709E", "versionEndExcluding": "17.0.5", "versionStartIncluding": "16.11", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "08FB7225-89F0-46D7-81AB-003D5D3BE137", "versionEndExcluding": "17.1.3", "versionStartIncluding": "17.1", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "579D177F-35DB-4988-82DD-0A5AA1AEDBA1", "versionEndExcluding": "17.2.1", "versionStartIncluding": "17.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab EE que afecta a todas las versiones desde la 16.11 anterior a la 17.0.5, desde la 17.1 anterior a la 17.1.3 y desde la 17.2 anterior a la 17.2.1, donde ciertas configuraciones de an\u00e1lisis a nivel de proyecto podr\u00edan filtrarse en DOM a miembros del grupo con roles de desarrollador o superiores."}], "id": "CVE-2024-5067", "lastModified": "2024-11-21T09:46:53.810", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 3.6, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-07-24T23:15:09.610", "references": [{"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504"}, {"source": "cve@gitlab.com", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2462303"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2502047"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458504"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/462427"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2462303"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2502047"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "cve@gitlab.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}