Description

An issue was discovered in GitLab CE/EE affecting all versions prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2, which allows a subdomain takeover in GitLab Pages.

Classification

CVE ID: CVE-2024-5528

CVSS Base Severity: LOW

CVSS Base Score: 3.5

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected Products

Vendor: GitLab

Product: GitLab

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.04% (probability of being exploited)

EPSS Percentile: 11.85% (scored less or equal to compared to others)

EPSS Date: 2025-03-06 (when was this score calculated)

References

https://gitlab.com/gitlab-org/gitlab/-/issues/464558
https://hackerone.com/reports/2523654

Timeline