CVE-2024-4278

2.7 lowEPSS 0.2%

Low (2.7) in gitlab gitlab. EPSS 0.2% chance of exploitation in the next 30 days.

An information disclosure issue has been discovered in GitLab EE affecting all versions starting from 16.5 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. A maintainer could obtain a Dependency Proxy password by editing a certain Dependency Proxy setting.

Severity

CVSS 3.1

2.7 low

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 14% of CVEs (scores of 2026-10-31)
CWE: CWE-821
Published: 2024-09-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/gitlab/-/issues/458484
https://hackerone.com/reports/2466205

Check your stack JSON