MEDIUM
CVE-2024-2191
CVSS
5.3
Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows merge request title to be visible publicly despite being set as project members only.
Summary dbcve.org
A broken access control vulnerability in GitLab CE/EE allows merge request titles that were configured to be visible only to project members to be exposed publicly. This information disclosure affects versions 16.9 through 16.11.4, 17.0 through 17.0.2, and 17.1 through 17.1.0.
Mitigation
Upgrade GitLab to version 16.11.5, 17.0.3, 17.1.1 or later to remediate the access control bypass on merge request title visibility.
Weakness (CWE)
CWE-284
Improper Access Control
EPSS Score
0.43%
Probability of exploitation in next 30 days
37th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.