CVE-2024-7586
BaseFortify
Publication date: 2025-06-20
Last updated on: 2025-08-12
Assigner: GitLab Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gitlab | gitlab | From 17.0.0 (inc) to 17.0.6 (exc) |
| gitlab | gitlab | From 17.0.0 (inc) to 17.0.6 (exc) |
| gitlab | gitlab | From 17.1.0 (inc) to 17.1.4 (exc) |
| gitlab | gitlab | From 17.1.0 (inc) to 17.1.4 (exc) |
| gitlab | gitlab | From 17.2.0 (inc) to 17.2.2 (exc) |
| gitlab | gitlab | From 17.2.0 (inc) to 17.2.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in GitLab EE versions from 17.0 up to but not including 17.0.6, 17.1 up to 17.1.4, and 17.2 up to 17.2.2 causes webhook deletion audit logs to preserve authentication credentials. This means that sensitive authentication information could be stored in audit logs when webhooks are deleted.
How can this vulnerability impact me? :
The vulnerability can lead to exposure of authentication credentials through audit logs, potentially allowing unauthorized access or misuse of those credentials. This could compromise the security of your GitLab instance or connected systems.