CVE-2024-12292

MEDIUM

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive inform...

Affects 1 product across 1 vendor.

CVSS 3.14.0
EPSS0.2%
Percentile11th
PatchUnknown
CVSS Vector — Plain English Requires local access, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no integrity impact, no availability impact.
CWE Weakness Definitions
CWE-532: CWE-532
Related Attack Patterns (CAPEC)
CAPEC-215 Fuzzing for application mapping
via CWE-532

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A vulnerability in GitLab CE/EE allows sensitive information passed in GraphQL mutations to be retained in GraphQL logs, affecting versions from 11.0 up to 17.4.5, 17.5 up to 17.5.3, and 17.6 up to 17.6.1.

BSID: BS-2024-GLOBAL-044707-M • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-12292?
A vulnerability in GitLab CE/EE allows sensitive information passed in GraphQL mutations to be retained in GraphQL logs, affecting versions from 11.0 up to 17.4.5, 17.5 up to 17.5.3, and 17.6 up to 17.6.1.
What is the CVSS score for CVE-2024-12292?
CVE-2024-12292 has CVSS 4.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS: 0.2%.
Is CVE-2024-12292 actively exploited?
No confirmed active exploitation of CVE-2024-12292 as of 2026-05-30.
How do I remediate CVE-2024-12292?
Priority: MEDIUM. Advisory: https://gitlab.com/gitlab-org/gitlab/-/issues/475211
What systems are affected by CVE-2024-12292?
CVE-2024-12292 affects Gitlab Gitlab.
Vulnerability Details
CVE IDCVE-2024-12292
BSIDBS-2024-GLOBAL-044707-M BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published2024-12-12
Last Modified2025-07-11
ICS Relevance0%
Weakness (CWE)
CWE-532
Domains
CLOUD
SourceNVD
Official Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker with access to the GraphQL logs could potentially retrieve sensitive information that was passed in GraphQL mutations, such as passwords or API keys.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Gitlab Gitlab ≥ 11.0.0, < 17.4.6 ≥ 17.5.0, < 17.5.4 ≥ 17.6.0, < 17.6.2
Remediation
View Vendor Advisory →

Remediation Priority: MEDIUM

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 672 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash5363e1827b452979185d1560fb09ab0f774d1c40712bc053e04d810ff2a751dfd90276a19acd64268817b926b31b6c85c7d488ce7c52b1a30445f75bf5407fa8
Related CVEs affecting Gitlab
CVE-2021-22205 10.0 An issue has been discovered in GitLab CE/EE affecting all versions starting ... CVE-2019-9174 10.0 An issue was discovered in GitLab Community and Enterprise Edition before 11.... CVE-2020-13300 10.0 GitLab CE/EE version 13.3 prior to 13.3.4 was vulnerable to an OAuth authoriz... CVE-2018-18843 10.0 The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 1... CVE-2026-85706 10.0 GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18...
View all Gitlab CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →