CVE-2024-5067

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An issue was discovered in GitLab EE affecting all versions starting from 16.11 prior to 17.0.5, starting from 17.1 prior to 17.1.3, and starting from 17.2 prior to 17.2.1 where certain project-level analytics settings could be leaked in DOM to group members with Developer or higher roles.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 16.11, < 17.0.5; >= 17.1, < 17.1.3; >= 17.2, < 17.2.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/458504Broken Link
https://gitlab.com/gitlab-org/gitlab/-/issues/462427Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/2462303Permissions Required
https://hackerone.com/reports/2502047Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/458504Broken Link
https://gitlab.com/gitlab-org/gitlab/-/issues/462427Exploit, Issue Tracking, Vendor Advisory
https://hackerone.com/reports/2462303Permissions Required
https://hackerone.com/reports/2502047Permissions Required

Timeline

Published: Jul 24, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-506714.3Incorrect access control in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows attackers with Authenticated User roles to obtain email add CVE-2024-506729.8A NoSQL injection vulnerability in Adapt Learning Adapt Authoring Tool <= 0.11.3 allows unauthenticated attackers to reset user and administ CVE-2024-506776.1A cross-site scripting (XSS) vulnerability in OroPlatform CMS v5.1 allows attackers to execute arbitrary web scripts or HTML via a crafted p CVE-2024-506846.5SunGrow iSolarCloud Android app V2.1.6.20241017 and prior uses an insecure AES key to encrypt client data (insufficient entropy). This may a CVE-2024-506859.1SunGrow iSolarCloud before the October 31, 2024 remediation, is vulnerable to insecure direct object references (IDOR) via the powerStationS CVE-2024-506869.1SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the commonService CVE-2024-506879.1SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the devService API CVE-2024-506889.8SunGrow iSolarCloud Android application V2.1.6.20241017 and prior contains hardcoded credentials. The application (regardless of the user ac CVE-2024-506899.1SunGrow iSolarCloud before the October 31, 2024 remediation is vulnerable to insecure direct object references (IDOR) via the orgService API CVE-2024-50699.8A vulnerability, which was classified as critical, has been found in SourceCodester Simple Online Mens Salon Management System 1.0. Affected CVE-2024-506906.5SunGrow WiNet-SV200.001.00.P027 and earlier versions contains a hardcoded password that can be used to decrypt all firmware updates.CVE-2024-506917.4SunGrow iSolarCloud Android app V2.1.6.20241104 and prior suffers from Missing SSL Certificate Validation. The app explicitly ignores certif