What is the CVSS score of CVE-2024-4994?

CVE-2024-4994 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.1%.

Which versions of Gitlab are affected by CVE-2024-4994?

GitLab instances running versions 16.1.0-16.11.4, 17.0.0-17.0.2, or 17.1.0 are vulnerable to cross-site request forgery (CSRF) attacks that could allow attackers to execute unauthorized actions…. A patch is available.

Is there a public PoC exploit available for CVE-2024-4994?

Yes, a public proof-of-concept exploit is available for CVE-2024-4994. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2024-4994?

Within 24 hours: Identify and inventory all GitLab instances and their versions; assess whether they fall within affected ranges and are accessible from the internet. Within 7 days: Implement network-level mitigations (WAF rules blocking suspicious GraphQL mutations, IP whitelisting, or disabling GraphQL API if not business-critical); review GraphQL API access logs for suspicious activity. Within 30 days: Monitor GitLab's security advisories for patch availability and plan immediate deployment upon release; consider upgrading to unaffected versions (16.11.5+, 17.0.3+, 17.1.1+) if patches become available.

Gitlab CVE-2024-4994

EUVD-2024-54992 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-06-20 cve@gitlab.com

CSRF Gitlab RCE

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Ubuntu

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 00:19 euvd

EUVD-2024-54992

Analysis Generated

Mar 15, 2026 - 00:19 vuln.today

PoC Detected

Aug 12, 2025 - 14:52 vuln.today

Public exploit code

CVE Published

Jun 20, 2025 - 19:15 nvd

HIGH 8.1

DescriptionCVE.org

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1.0 before 16.11.5, all versions starting from 17.0 before 17.0.3, all versions starting from 17.1.0 before 17.1.1 which allowed for a CSRF attack on GitLab's GraphQL API leading to the execution of arbitrary GraphQL mutations.

AnalysisAI

CVE-2024-4994 is a Cross-Site Request Forgery (CSRF) vulnerability in GitLab's GraphQL API that allows unauthenticated attackers to execute arbitrary GraphQL mutations through a malicious website visited by authenticated GitLab users. This affects GitLab CE/EE versions 16.1.0-16.11.4, 17.0.0-17.0.2, and 17.1.0, with a CVSS score of 8.1 indicating high severity. The vulnerability requires user interaction (clicking a malicious link) but can result in unauthorized data manipulation or system compromise depending on the mutations executed.

Technical ContextAI

The vulnerability exists in GitLab's GraphQL API endpoint implementation, which failed to implement proper CSRF token validation for state-changing operations (mutations). GraphQL mutations are the write/modification operations within GraphQL, analogous to POST/PUT/DELETE in REST APIs. The root cause is CWE-352 (Cross-Site Request Forgery), where the API accepts authenticated GraphQL mutation requests from cross-origin sources without verifying that the request originated from a legitimate GitLab interface. This is a classic CSRF vulnerability pattern where an attacker crafts a malicious webpage containing GraphQL mutation payloads that execute when a logged-in user visits the attacker's site. The vulnerability affects CPE:2.3:a:gitlab:gitlab:* versions spanning multiple release branches (16.1.x, 17.0.x, 17.1.x), indicating the vulnerability was introduced or persisted across multiple major releases.

RemediationAI

Immediate remediation: (1) Upgrade GitLab to patched versions: 16.11.5 or later (for 16.1.x-16.11.x users), 17.0.3 or later (for 17.0.x users), or 17.1.1 or later (for 17.1.x users); (2) Follow GitLab's official upgrade procedure to ensure database migrations and service restarts complete successfully. Short-term mitigations if immediate patching is not possible: (1) Implement Web Application Firewall (WAF) rules to detect and block GraphQL mutation requests originating from cross-origin sources (check for missing or invalid CSRF tokens on GraphQL endpoints); (2) Restrict GraphQL API access to trusted networks using network-level controls; (3) Implement Content Security Policy (CSP) headers to limit the ability of malicious sites to forge requests. Monitor for signs of exploitation by reviewing GraphQL mutation logs for suspicious activity, particularly mutations that alter user permissions, group memberships, or project data from unexpected sources. For GitLab.com SaaS users, GitLab has patched the platform; self-managed instances must apply patches manually.