CVE-2024-3303
Last modified
CVE-2024-3303 is a medium-severity vulnerability rated 5.7/10 on the CVSS scale. An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 16.0.0, < 17.6.5 |
| Gitlab | Gitlab | >= 17.7.0, < 17.7.4 |
| Gitlab | Gitlab | >= 17.8.0, < 17.8.2 |
References
- https://gitlab.com/gitlab-org/gitlab/-/issues/454460Exploit, Issue Tracking
- https://hackerone.com/reports/2418620Permissions Required
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2024-3303?
How severe is CVE-2024-3303?
How do I fix CVE-2024-3303?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2024
- CVE-2024-33024Transient DOS while parsing the ML IE when a beacon with len…7.5
- CVE-2024-33025Transient DOS while parsing the BSS parameter change count o…7.5
- CVE-2024-33026Transient DOS while parsing probe response and assoc respons…7.5
- CVE-2024-33027Memory corruption can occur when arbitrary user-space app ga…7.8
- CVE-2024-33028Memory corruption as fence object may still be accessed in t…7.8
- CVE-2024-33029Memory corruption while handling the PDR in driver for getti…6.7
- CVE-2024-33030Memory corruption while parsing IPC frequency table paramete…6.7
- CVE-2024-33031Memory corruption while processing the update SIM PB records…6.7
- CVE-2024-33032Memory corruption when the user application modifies the sam…6.7
- CVE-2024-33033Memory corruption while processing IOCTL calls to unmap the …7.8
- CVE-2024-33034Memory corruption can occur if VBOs hold outdated or invalid…7.8
- CVE-2024-33035Memory corruption while calculating total metadata size when…8.4
Are you affected by CVE-2024-3303?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST