Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1, in which unauthorized users could manipulate the status of issues in public projects.

Classification

CVE ID: CVE-2024-12431

CVSS Base Severity: MEDIUM

CVSS Base Score: 4.3

Affected Products

Vendor: GitLab

Product: GitLab

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 17.83% (scored less or equal to compared to others)

EPSS Date: 2025-02-06 (when was this score calculated)

References

https://gitlab.com/gitlab-org/gitlab/-/issues/508742
https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#unauthorized-user-can-manipulate-status-of-issues-in-public-projects
https://hackerone.com/reports/2877710

Timeline