CVE-2024-4994

Description

The vulnerability exists due to insufficient validation of the HTTP request origin on GraphQL API "IntrospectionQuery". A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.

References

https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released/#run-pipelines-as-any-user

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3