CVE-2024-2454

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 15.11, < 16.9.7; >= 16.10, < 16.10.5; >= 16.11, < 16.11.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/450405Broken Link
https://hackerone.com/reports/2408226Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/450405Broken Link
https://hackerone.com/reports/2408226Permissions Required

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-245439.8Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42_multi allows a remote attacker CVE-2024-245486.5Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise us CVE-2024-245497.5Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if CVE-2024-24555.4The Element Pack - Addon for Elementor Page Builder WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t CVE-2024-245508.1A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through CVE-2024-245518.8A security vulnerability has been identified in Bludit, allowing authenticated attackers to execute arbitrary code through the Image API. Th CVE-2024-245528.8A session fixation vulnerability in Bludit allows an attacker to bypass the server's authentication if they can trick an administrator or an CVE-2024-245537.5Bludit uses the SHA-1 hashing algorithm to compute password hashes. Thus, attackers could determine cleartext passwords with brute-force att CVE-2024-245548.2Bludit uses predictable methods in combination with the MD5 hashing algorithm to generate sensitive tokens such as the API token and the use CVE-2024-245566.1urql is a GraphQL client that exposes a set of helpers for several frameworks. The `@urql/next` package is vulnerable to XSS. To exploit th CVE-2024-245577.8Moby is an open-source project created by Docker to enable software containerization. The classic builder cache system is prone to cache poi CVE-2024-245586.1TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The `@tanstack/react-query-nex