CVE-2024-7404

6.5 mediumEPSS 0.6%

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 46% of CVEs (scores of 2026-10-31)
CWE: CWE-1021
Published: 2024-11-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery
https://gitlab.com/gitlab-org/gitlab/-/issues/476670
https://hackerone.com/reports/2627925

Check your stack JSON