CVE-2024-3958
Improper Control of Generation of Code ('Code Injection') in GitLab
Severity Score
5.3
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allows someone to abuse a discrepancy between the Web application display and the git command line interface to social engineer victims into cloning non-trusted code.
Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 17.0.6, 17.1 anterior a 17.1.4 y 17.2 anterior a 17.2.2. Se encontró un problema que permite a alguien abusar de una discrepancia entre la visualización de la aplicación web y la interfaz de línea de comando de git para realizar ingeniería social a las víctimas para clonar código no confiable.
*Credits:
Thanks [st4nly0n](https://hackerone.com/st4nly0n) for reporting this vulnerability through our HackerOne bug bounty program
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-04-18 CVE Reserved
- 2024-08-08 CVE Published
- 2024-08-30 EPSS Updated
- 2024-09-17 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (0)
| URL | Tag | Source |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | < 17.0.6 Search vendor "GitLab" for product "GitLab" and version " < 17.0.6" | en |
Affected
| ||||||
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | >= 17.1.0 < 17.1.4 Search vendor "GitLab" for product "GitLab" and version " >= 17.1.0 < 17.1.4" | en |
Affected
| ||||||
| GitLab Search vendor "GitLab" | GitLab Search vendor "GitLab" for product "GitLab" | >= 17.2.0 < 17.2.2 Search vendor "GitLab" for product "GitLab" and version " >= 17.2.0 < 17.2.2" | en |
Affected
| ||||||