CVE-2024-9870
Unintended Proxy or Intermediary ('Confused Deputy') in GitLab
8.8
HIGH
CVSS 3.1
EPSS 0.03%
Description
An external service interaction vulnerability in GitLab EE affecting all versions from 15.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 allows an attacker to send requests from the GitLab server to unintended services.
How to fix CVE-2024-9870
To remediate CVE-2024-9870, upgrade the affected package to a fixed version below.
- —upgrade to 17.8.2 or later
Is CVE-2024-9870 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 15.11.0, < 17.8.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |