mirror of
https://github.com/CVEProject/cvelist.git
synced 2025-08-04 08:44:25 +00:00
110 lines
3.8 KiB
JSON
110 lines
3.8 KiB
JSON
{
|
|
"data_version": "4.0",
|
|
"data_type": "CVE",
|
|
"data_format": "MITRE",
|
|
"CVE_data_meta": {
|
|
"ID": "CVE-2024-4283",
|
|
"ASSIGNER": "cve@gitlab.com",
|
|
"STATE": "PUBLIC"
|
|
},
|
|
"description": {
|
|
"description_data": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow."
|
|
}
|
|
]
|
|
},
|
|
"problemtype": {
|
|
"problemtype_data": [
|
|
{
|
|
"description": [
|
|
{
|
|
"lang": "eng",
|
|
"value": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')",
|
|
"cweId": "CWE-601"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
},
|
|
"affects": {
|
|
"vendor": {
|
|
"vendor_data": [
|
|
{
|
|
"vendor_name": "GitLab",
|
|
"product": {
|
|
"product_data": [
|
|
{
|
|
"product_name": "GitLab",
|
|
"version": {
|
|
"version_data": [
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "11.1",
|
|
"version_value": "17.1.7"
|
|
},
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "17.2",
|
|
"version_value": "17.2.5"
|
|
},
|
|
{
|
|
"version_affected": "<",
|
|
"version_name": "17.3",
|
|
"version_value": "17.3.2"
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|
|
},
|
|
"references": {
|
|
"reference_data": [
|
|
{
|
|
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/458502",
|
|
"refsource": "MISC",
|
|
"name": "https://gitlab.com/gitlab-org/gitlab/-/issues/458502"
|
|
},
|
|
{
|
|
"url": "https://hackerone.com/reports/2474286",
|
|
"refsource": "MISC",
|
|
"name": "https://hackerone.com/reports/2474286"
|
|
}
|
|
]
|
|
},
|
|
"solution": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Upgrade to versions 17.1.7, 17.2.5, 17.3.2 or above."
|
|
}
|
|
],
|
|
"credits": [
|
|
{
|
|
"lang": "en",
|
|
"value": "Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program"
|
|
}
|
|
],
|
|
"impact": {
|
|
"cvss": [
|
|
{
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "HIGH",
|
|
"privilegesRequired": "LOW",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "HIGH",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 6.4,
|
|
"baseSeverity": "MEDIUM"
|
|
}
|
|
]
|
|
}
|
|
} |