CVE-2024-2743
Description
An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables.
Summary dbcve.org
This is an authorization bypass vulnerability in GitLab's on-demand DAST (Dynamic Application Security Testing) scanning feature. An attacker can modify DAST scan configurations without proper permissions, potentially leaking sensitive variables used in security scans. The issue stems from missing or inadequate authorization checks in the DAST scan modification endpoints.
Mitigation
Upgrade GitLab to version 17.1.7, 17.2.5, or 17.3.2 or later. If immediate patching is not possible, restrict access to on-demand DAST scan endpoints and audit existing scan configurations for unauthorized modifications.