GCVE - cpe:2.3:a:gitlab:gitlab:17.1.0:*:*:*:community:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:gitlab:gitlab:17.1.0:*:*:*:community:*:*:*

part: a version: 17.1.0 update: *

Vendor	Gitlab (`57573e99-56e6-5fad-895e-0ce7fffc5b90`)
Product	Gitlab (`5414fcda-a172-5f72-b6e4-b415a19d21eb`)
Edition	*
Language	*
Software edition	community
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:gitlab/gitlab-org/gitlab`	purl2cpe	2026-06-01 10:14:46.352121

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2024-5655`	vulnerable	2026-06-08 06:56:16.883383	Improper Access Control in GitLab CRITICAL (9.6) An issue was discovered in GitLab CE/EE affecting all versions starting from 15.8 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to trigger a pipeline as another user under certain circumstances. Published: 2024-06-26T23:30:55.421Z Updated: 2024-09-17T15:33:21.131Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/465862 https://hackerone.com/reports/2536320	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-5430`	vulnerable	2026-06-08 06:56:16.005902	Improper Access Control in GitLab MEDIUM (6.8) An issue was discovered in GitLab CE/EE affecting all versions starting from 16.10 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows a project maintainer can delete the merge request approval policy via graphQL. Published: 2024-06-26T23:30:50.436Z Updated: 2024-08-29T15:04:59.442Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/464017 https://hackerone.com/reports/2520947	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4994`	vulnerable	2026-06-08 06:52:08.726187	Cross-Site Request Forgery (CSRF) in GitLab HIGH (8.1) An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations. Published: 2025-06-20T18:14:37.887Z Updated: 2025-06-23T15:22:37.297Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/462012 https://hackerone.com/reports/2473644	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4901`	vulnerable	2026-06-08 06:50:18.994367	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab HIGH (8.7) An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes. Published: 2024-06-26T23:31:05.422Z Updated: 2024-09-17T17:02:23.803Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/461773 https://hackerone.com/reports/2500163	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4557`	vulnerable	2026-06-08 06:50:18.132294	Uncontrolled Resource Consumption in GitLab MEDIUM (6.5) Multiple Denial of Service (DoS) conditions has been discovered in GitLab CE/EE affecting all versions starting from 1.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1 which allowed an attacker to cause resource exhaustion via banzai pipeline. Published: 2024-06-26T23:31:10.425Z Updated: 2024-08-29T15:04:58.095Z Open on db.gcve.eu Reference links https://gitlab.com/gitlab-org/gitlab/-/issues/460517 https://hackerone.com/reports/2485172	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4025`	vulnerable	2026-06-08 06:50:16.866203	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-4011`	vulnerable	2026-06-08 06:50:16.843248	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3959`	vulnerable	2026-06-08 06:43:51.977127	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-3115`	vulnerable	2026-06-08 06:41:52.514175	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2191`	vulnerable	2026-06-08 06:33:30.548799	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-2177`	vulnerable	2026-06-08 06:33:30.485526	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1816`	vulnerable	2026-06-08 06:27:14.599792	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2024-1493`	vulnerable	2026-06-08 06:25:40.281117	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.