CVE-2024-1539

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Feb 5, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-15408.2A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralCVE-2024-15415.4The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htmCVE-2024-15435.5The side-channel protected T-Table implementation in wolfSSL up to version 5.6.5 protects against a side-channel attacker with cache-line reCVE-2024-15444.9Generating the ECDSA nonce k samples a random number r and then truncates this randomness with a modular reduction mod n where n is the orCVE-2024-15458.8Fault Injection vulnerability in RsaPrivateDecryption function in wolfssl/wolfcrypt/src/rsa.c in WolfSSL wolfssl5.6.6 on Linux/Windows allowCVE-2024-15467.5When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memoCVE-2024-15476.5Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victCVE-2024-15484.3A website could have obscured the fullscreen notification by using a dropdown select input element. This could have led to user confusion anCVE-2024-15496.1If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in usCVE-2024-15506.1A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-posCVE-2024-15516.1Set-Cookie response headers were being incorrectly honored in multipart HTTP responses. If an attacker could control the Content-Type responCVE-2024-15527.5Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects
CVE-2024-1539: Medium severity, CVSS 5.3 | Vulnix