CVE-2024-2743

Name of the Vulnerable Software and Affected Versions GitLab-EE versions 13.3 through 17.1.7 GitLab-EE versions 17.2 through 17.2.5 GitLab-EE versions 17.3 through 17.3.2

Description An issue was discovered in GitLab-EE that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. This issue affects versions starting with 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2.

Recommendations For GitLab-EE versions 13.3 through 17.1.7, update to version 17.1.7 or later to resolve the issue. For GitLab-EE versions 17.2 through 17.2.5, update to version 17.2.5 or later to resolve the issue. For GitLab-EE versions 17.3 through 17.3.2, update to version 17.3.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the DAST scan feature until a patch is available.