Medium

Analysis Summary

CVE-2024-7610 CVSS:4.3

GitLab is vulnerable to a denial of service, caused by an error while parsing results from Elasticsearch. A remote authenticated attacker could exploit this vulnerability to cause a denial of service.

CVE-2024-7554 CVSS:4.9

GitLab could allow a remote authenticated attacker to obtain sensitive information. By sending a specially crafted API request, an attacker could exploit this vulnerability to log access tokens.

Impact

• Denial of Service
• Information Disclosure

Indicators of Compromise

CVE

• CVE-2024-7610
• CVE-2024-7554

Affected Vendors

Remediation

Upgrade to the latest version of GitLab, available from the GitLab Website.

CVE-2024-7610

CVE-2024-7554