Loading vulnerability…
GitLab Pages Subdomain Takeover
CVE-2024-5528 is an improper access control issue in GitLab Community Edition and Enterprise Edition GitLab Pages that allows subdomain takeover. It affects versions before 16.11.6, versions 17.0 before 17.0.4, and versions 17.1 before 17.1.2.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may take over a GitLab Pages subdomain associated with an affected installation.
If you can’t patch tonight, do this now.
Install the available GitLab security updates and follow the GitLab security bulletin guidance.
Patch, then assume compromise.
Upgrade GitLab Community Edition or Enterprise Edition to version 16.11.6, 17.0.4, 17.1.2, or a later applicable release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.