Cloudanix VulnDB

CVE-2024-10043

None

CVSS

—

EPSS

0.5%

Published

Dec 12, 2024

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug let some team members see private incident names they were not supposed to access.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The flaw permits group users to retrieve confidential incident titles by accessing the Wiki History Diff feature, bypassing intended access controls on incident metadata.

Why it matters to the business

Sensitive incident details may be exposed to unauthorized group members, increasing risk of information leakage that could affect operational confidentiality and incident response processes.

How an attack unfolds

An authenticated group user navigates to the wiki history diff view associated with an incident and observes the confidential title that should be restricted.

How to fix it

Upgrade GitLab EE to 17.4.6, 17.5.4, or 17.6.2 or later where the issue is resolved in commit 25a55583bbcf724ad625848d48a529467e7c7097.

How to confirm the fix worked

Confirm the installed version meets or exceeds the fixed releases and verify that confidential incident titles are no longer visible in wiki history diffs for group users without explicit incident access.

Typical attack path

  1. Obtain group membership in the affected GitLab EE project
  2. Access the Wiki History Diff feature for an incident
  3. View and extract the confidential incident title displayed in the diff

How to detect it

Examine GitLab audit and access logs for unusual wiki history diff queries on incidents; no widespread exploitation indicators are known given the low EPSS and absence from KEV.

What your security team should do

  • Apply the specified version upgrades immediately across all GitLab EE instances
  • Review group membership and wiki access permissions to limit exposure
  • Monitor for any post-upgrade access anomalies related to wiki features

The record

An issue has been discovered in GitLab EE affecting all versions starting from 14.3 before 17.4.6, all versions starting from 17.5 before 17.5.4 all versions starting from 17.6 before 17.6.2, that allows group users to view confidential incident title through the Wiki History Diff feature, potentially leading to information disclosure.

Affected packages

Ecosystem Package Introduced Fixed
Bitnami gitlab 14.3.0 17.4.6
Ubuntu:16.04:LTS gitlab 0 No fix
Ubuntu:Pro:16.04:LTS gitlab 0 No fix

Related vulnerabilities