CVE-2024-3959

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows private job artifacts can be accessed by any user.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published
Jun 27, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-395907.5Multiple invalid pointer dereference vulnerabilities exist in the OpenPLC Runtime EtherNet/IP parser functionality of OpenPLC_v3 16bf8bac1a3CVE-2024-395915.3SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges cCVE-2024-395926.5Elements of PDCE does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This aCVE-2024-395935.7SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definition response. SuccessfCVE-2024-395946.1SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user controlled inputs, resulting in ReflCVE-2024-395955.4SAP Business Warehouse - Business Planning and Simulation application does not sufficiently encode user-controlled inputs, resulting in StorCVE-2024-395964.3Due to missing authorization checks, SAP Enable Now allows an author to escalate privileges to access information which should otherwise be CVE-2024-395977.2In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early lCVE-2024-395987.7SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by speciallCVE-2024-395994.7Due to a Protection Mechanism Failure in SAP NetWeaver Application Server for ABAP and ABAP Platform, a developer can bypass the configured CVE-2024-396004.2Under certain conditions, the memory of SAP GUI for Windows contains the password used to log on to an SAP system, which might allow an attaCVE-2024-396016.5A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1