CVE-2024-3303 — Improper Neutralization of Input Used for LLM Prompting in GitLab

CVE-2024-3303

Improper Neutralization of Input Used for LLM Prompting in GitLab PUBLISHED

Description (CNA)

An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 17.6.5, starting from 17.7 prior to 17.7.4, and starting from 17.8 prior to 17.8.2, which allows an attacker to exfiltrate contents of a private issue using prompt injection.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 16.0 before 17.6.5; affected 17.7 before 17.7.4; affected 17.8 before 17.8.2

CWE

CWE-1427

References

https://gitlab.com/gitlab-org/gitlab/-/issues/454460
https://hackerone.com/reports/2418620

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.