CVE-2024-2177

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-1021

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.3, < 16.11.5; >= 17.0, < 17.0.3; >= 17.1, < 17.1.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/444467Exploit, Issue Tracking
https://hackerone.com/reports/2383443Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/444467Exploit, Issue Tracking
https://hackerone.com/reports/2383443Permissions Required

Timeline

Published: Jul 9, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-217717.5For unspecified traffic patterns, BIG-IP AFM IPS engine may spend an excessive amount of time matching the traffic against signatures, resul CVE-2024-217727.8Uncontrolled search path in some Intel(R) Advisor software before version 2024.0 may allow an authenticated user to potentially enable escal CVE-2024-217738.8Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute CVE-2024-217746.7Uncontrolled search path in some Intel(R) Processor Identification Utility software before versions 6.10.34.1129, 7.1.6 may allow an authent CVE-2024-217758.8Zoho ManageEngine Exchange Reporter Plus versions 5714 and below are vulnerable to the Authenticated SQL injection in report exporting featu CVE-2024-217777.3Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an authenticated user t CVE-2024-217787.2A heap-based buffer overflow vulnerability exists in the configuration file mib_init_value_array functionality of Realtek rtl819x Jungle SDK CVE-2024-21787.5A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollm CVE-2024-217807.5Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. Processing a specially crafted command may result in a CVE-2024-217817.2Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable information disclosure or deni CVE-2024-217826.7BIG-IP or BIG-IQ Resource Administrators and Certificate Managers who have access to the secure copy (scp) utility but do not have access to CVE-2024-217834.8Integer overflow for some Intel(R) VPL software before version 24.1.4 may allow an authenticated user to potentially enable escalation of pr