MEDIUM
CVE-2024-7060
CVSS
6.5
Description
An information disclosure vulnerability in GitLab CE/EE in project/group exports affecting all versions from 15.4 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows unauthorized users to view the resultant export.
Summary dbcve.org
An access control flaw in GitLab's project and group export functionality allows unauthenticated or unauthorized users to access export files they should not be able to view. The export generation process does not properly validate requester permissions before serving the exported data.
Mitigation
Upgrade GitLab to versions 17.0.5, 17.1.3, 17.2.1 or later. Review export access controls and audit recent export activity for unauthorized access.
Weakness (CWE)
CWE-200
Information Exposure
EPSS Score
0.3%
Probability of exploitation in next 30 days
23.2th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.