{"id":"CVE-2024-7586","aliases":["BIT-gitlab-2024-7586","EUVD-2024-54693","GHSA-wcpq-3gmh-2fh6","UBUNTU-CVE-2024-7586"],"status":"published","title":"Insertion of Sensitive Information into Log File in GitLab","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","severity":{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00308,"percentile":0.23906,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2025-06-20T13:58:37Z","modified":"2026-10-30T10:47:00Z","fixes":[{"ecosystem":"Bitnami","package":"gitlab","fixed_in":["17.2.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"gitlab","ranges":[{"type":"SEMVER","events":[{"introduced":"17.0.0"},{"fixed":"17.2.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"gitlab","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.4.3+dfsg-9","8.4.3+dfsg-12","8.5.8+dfsg-5"]}],"products":[{"vendor":"gitlab","product":"gitlab"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/463866","tags":["issue-tracking","permissions-required","Broken Link","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7586","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-wcpq-3gmh-2fh6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7586.json","tags":["advisory"]},{"url":"git://git@gitlab.com:gitlab-org/gitlab.git","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2024-7586","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7586","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-7586","title":"Insertion of Sensitive Information into Log File in GitLab","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T13:58:37.159Z","modified":"2025-06-20T14:53:39.33Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-54693","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T13:58:37Z","modified":"2025-06-20T14:53:39Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T20:32:19.507179Z"}],"ghsa":[{"id":"GHSA-wcpq-3gmh-2fh6","title":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6,...","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T15:30:36Z","modified":"2025-06-20T15:30:41Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:02:46.307418Z"}],"nvd":[{"id":"CVE-2024-7586","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T14:15:26.983Z","modified":"2026-06-17T08:20:29.97Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-7586","title":"Insertion of Sensitive Information into Log File in GitLab","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T13:58:37.159Z","modified":"2026-10-30T10:47:00.398799519Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"UBUNTU-CVE-2024-7586","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-20T14:15:00Z","modified":"2025-10-24T05:06:46Z","cvss":[{"version":"3.1","score":4.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"BIT-gitlab-2024-7586","title":"Insertion of Sensitive Information into Log File in GitLab","description":"An issue was discovered in GitLab EE affecting all versions starting from 17.0 prior to 17.0.6, starting from 17.1 prior to 17.1.4, and starting from 17.2 prior to 17.2.2, where webhook deletion audit log preserved auth credentials.","status":"published","published":"2025-06-24T15:13:54.274Z","modified":"2025-08-13T06:08:53.695Z","updated_at":"2026-11-02T15:28:30.405543Z"}]}}