What is CVE-2024-10240?

CVE-2024-10240 is a medium-severity vulnerability in Gitlab, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 5.3/10. Published 2024-11-26.

How severe is CVE-2024-10240?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Gitlab

CVE-2024-10240

An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some information about an MR in a private project, under certain circumstances.

EPSS: 0.005 (42.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Gitlab — versions 17.3, 17.4, 17.5

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

cve@gitlab.com (issue-tracking, permissions-required, Broken Link)
cve@gitlab.com (Vendor Advisory)

Frequently asked questions

What is CVE-2024-10240?: CVE-2024-10240 is a medium-severity vulnerability in Gitlab, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 5.3/10. Published 2024-11-26.
How severe is CVE-2024-10240?: Medium severity. CVSS v3 base score is 5.3 out of 10.