CVE-2024-12380

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-12380
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-12380.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-12380
Aliases
Downstream
Published
2025-03-13T05:56:14.642Z
Modified
2025-11-30T11:53:54.914022Z
Severity
  • 4.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
Generation of Error Message Containing Sensitive Information in GitLab
Details

An issue was discovered in GitLab EE/CE affecting all versions starting from 11.5 before 17.7.7, all versions starting from 17.8 before 17.8.5, all versions starting from 17.9 before 17.9.2. Certain user inputs in repository mirroring settings could potentially expose sensitive authentication information.

Database specific 
{
    "cna_assigner": "GitLab",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12380.json",
    "cwe_ids": [
        "CWE-209"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
cb71fca38c3de0c212685f97a46ee8426f63d301
Fixed
14925e89dd8fcbadc4624ab451d64238cc651365
Database specific 
{
    "versions": [
        {
            "introduced": "11.5"
        },
        {
            "fixed": "17.7.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f03594b9e09b648c839e9c008286a24c93c82373
Fixed
d7f0517433cc803ed10f8fed5b6b667d66f7a296
Database specific 
{
    "versions": [
        {
            "introduced": "17.8"
        },
        {
            "fixed": "17.8.5"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
f5041566b342c2f30a8d63b8117272c454e18410
Fixed
56dedd4cf9e7ce144b36c34ed45aa57355859659
Database specific 
{
    "versions": [
        {
            "introduced": "17.9"
        },
        {
            "fixed": "17.9.2"
        }
    ]
}

Affected versions

v17.*

v17.8.0-ee
v17.8.1-ee
v17.8.2-ee
v17.8.3-ee
v17.8.4-ee
v17.9.0-ee
v17.9.1-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-12380.json"