CVE-2024-8977

—

CVSS 3.1

8.1 high

EPSS

<1%p44

Published

Oct 10, 2024 (Oct 10, 2024)

Modified

Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.10 prior to 17.2.9, from 17.3 prior to 17.3.5, and from 17.4 prior to 17.4.2. Instances with Product Analytics Dashboard configured and enabled could be vulnerable to SSRF attacks.

Vendors: gitlab
Products: gitlab
Weakness: CWE-918
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.6%)

In the news2 stories

GitLab fixed a critical flaw that could allow arbitrary CI/CD pipeline execution

Security AffairsOct 11, 17:34 UTC · Oct 11, 2024Vulnerability CVE-2024-9164 CVE-2024-8970 CVE-2024-8977+5 CVEs

New Critical GitLab Vulnerability Could Allow Arbitrary CI/CD Pipeline Execution

The Hacker NewsOct 11, 06:29 UTC · Oct 11, 2024Vulnerability in the wildCVE-2024-9164 CVE-2024-8970 CVE-2024-8977+6 CVEs