CVE-2024-9631 | THREATINT

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 13.6 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, where viewing diffs of MR with conflicts can be slow.

PUBLISHED Reserved 2024-10-08 | Published 2025-02-05 | Updated 2025-02-05 | Assigner GitLab

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-407: Inefficient Algorithmic Complexity

Product status

Default status

unaffected

13.6 (semver) before 17.2.9

affected

17.3 (semver) before 17.3.5

affected

17.4 (semver) before 17.4.2

affected

Credits

Thanks [a92847865](https://hackerone.com/a92847865) for reporting this vulnerability through our HackerOne bug bounty program finder

References

gitlab.com/gitlab-org/gitlab/-/issues/480867 exploit

gitlab.com/gitlab-org/gitlab/-/issues/480867 (GitLab Issue #480867) issue-tracking permissions-required

hackerone.com/reports/2650086 (HackerOne Bug Bounty Report #2650086) technical-description exploit permissions-required

cve.org (CVE-2024-9631)

nvd.nist.gov (CVE-2024-9631)

Download JSON