CVE-2024-4099

An issue has been discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.2.8, from 17.3 prior to 17.3.4, and from 17.4 prior to 17.4.1. An AI feature was found to read unsanitized content in a way that could have allowed an attacker to hide prompt injection.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*

History

04 Oct 2024, 17:33

Type Values Removed Values Added
First Time Gitlab gitlab
Gitlab
CVSS v2 : unknown
v3 : 3.1
v2 : unknown
v3 : 5.3
References () https://gitlab.com/gitlab-org/gitlab/-/issues/457798 - () https://gitlab.com/gitlab-org/gitlab/-/issues/457798 - Broken Link
References () https://hackerone.com/reports/2459597 - () https://hackerone.com/reports/2459597 - Permissions Required
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*

30 Sep 2024, 12:46

Type Values Removed Values Added
Summary
  • (es) Se ha descubierto un problema en GitLab EE que afecta a todas las versiones a partir de la 16.0 anterior a la 17.2.8, de la 17.3 anterior a la 17.3.4 y de la 17.4 anterior a la 17.4.1. Se descubrió que una función de IA leía contenido no desinfectado de una manera que podría haber permitido a un atacante ocultar la inyección de mensajes.

26 Sep 2024, 23:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-09-26 23:15

Updated : 2024-10-04 17:33


NVD link : CVE-2024-4099

Mitre link : CVE-2024-4099

CVE.ORG link : CVE-2024-4099


JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-116

Improper Encoding or Escaping of Output