CVE-2024-11129

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions from 17.1 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. This allows attackers to perform targeted searches with sensitive keywords to get the count of issues containing the searched term."

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-209

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 17.1, < 17.8.7; >= 17.9, < 17.9.6; >= 17.10, < 17.10.4

References

https://gitlab.com/gitlab-org/gitlab/-/issues/503722Broken Link
https://hackerone.com/reports/2717400Permissions Required

Timeline

Published: Apr 10, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-11139.8A vulnerability, which was classified as critical, was found in openBI up to 1.0.8. This affects the function uploadUnity of the file /appli CVE-2024-111304.8A vulnerability was found in ZZCMS up to 2023. It has been rated as problematic. Affected by this issue is some unknown functionality of the CVE-2024-111319.8A vulnerability regarding out-of-bounds read is found in the video interface. This allows remote attackers to execute arbitrary code via uns CVE-2024-111325.4The Eventer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.9.9.4 due t CVE-2024-111335.3The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'handle_pdf_download_CVE-2024-111346.5The Eventer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'eventer_export_booki CVE-2024-111357.5The Eventer plugin for WordPress is vulnerable to SQL Injection via the 'event' parameter in the 'eventer_get_attendees' function in all ver CVE-2024-111368.2The default TCL Camera application exposes a provider vulnerable to path traversal vulnerability. Malicious application can supply malicious CVE-2024-111377.5An Insecure Direct Object Reference (IDOR) vulnerability exists in the `PATCH /v1/runs/:id/score` endpoint of lunary-ai/lunary version 1.6.0 CVE-2024-111389.8A vulnerability classified as problematic has been found in DedeCMS 5.7.116. This affects an unknown part of the file /dede/uploads/dede/fri CVE-2024-111394.6CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could allow local attackers to ex CVE-2024-11149.8A vulnerability has been found in openBI up to 1.0.8 and classified as critical. This vulnerability affects the function dlfile of the file