CVE-2024-12380
Info Disclosure in Gitlab 11.5.0 – 17.7.7
Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-12380 is a medium-severity Generation of Error Message Containing Sensitive Information (CWE-209) vulnerability in Gitlab Gitlab. Its CVSS base score is 4.4 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Protocol or Service Impersonation (T1001.003); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-11 (Error Handling) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-12380 is a vulnerability discovered in GitLab Enterprise Edition (EE) and Community Edition (CE), affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, and all versions starting from 17.9 before 17.9.2. The issue arises from certain user inputs in repository mirroring settings that could potentially expose sensitive authentication information. It is classified under CWE-209 and carries a CVSS v3.1 base score of 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N), indicating a moderate severity with high confidentiality impact but no integrity or availability effects.
Exploitation requires network access, high attack complexity, and high privileges (PR:H), with no user interaction needed. An authenticated attacker possessing elevated privileges could leverage the flawed handling of inputs in repository mirroring settings to disclose sensitive authentication details, potentially compromising credentials used for mirroring operations.
Mitigation is achieved by upgrading to patched GitLab versions: 17.7.7 or later for the 17.7 series, 17.8.5 or later for the 17.8 series, and 17.9.2 or later for the 17.9 series. Further details on the issue and resolution are documented in the GitLab issue tracker at https://gitlab.com/gitlab-org/gitlab/-/issues/508557 and the corresponding HackerOne disclosure report at https://hackerone.com/reports/2868951.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54077
Vulnerability Data
An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive…
more
authentication information.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V16.5.1
Mitigating Controls (NIST 800-53 r5) AI
si-11 directly requires error messages to avoid revealing exploitable information about the system or its data.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require sanitized error handling to prevent sensitive data disclosure.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.