Loading vulnerability…
Unauthorized Issue Status Manipulation in GitLab CE/EE
CVE-2024-12431 is a vulnerability in GitLab CE/EE affecting versions from 15.5 before 17.5.5, 17.6 before 17.6.3, and 17.7 before 17.7.1. The flaw allows unauthorized users to manipulate the status of issues in public projects, bypassing intended access controls. This could be exploited by attackers to alter project workflows or disrupt project management processes.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Unauthorized users can change the status of issues in public projects, potentially leading to workflow disruption, confusion, or abuse of project management features. This undermines the integrity of project tracking and could be leveraged for social engineering or sabotage.
If you can’t patch tonight, do this now.
Restrict public project visibility where possible, monitor issue status changes for anomalies, and apply the latest security updates promptly.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 17.5.5, 17.6.3, 17.7.1 or later, where the vulnerability has been patched.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.