Security readout for executives and security teams
Plain-English summary
A logged-in attacker could make GitLab EE consume excessive resources through a GraphQL vulnerability-count feature. The main business impact is service disruption, not data theft or tampering, but GitLab outages can block engineering, security triage, and release workflows.
Executive priority
Treat this as a prompt patching item for affected GitLab EE environments. It is not described as data compromise, but availability loss can materially disrupt software delivery and vulnerability management operations.
Technical view
CVE-2024-1066 is CWE-770 resource exhaustion in GitLab EE. Affected versions are 13.3.0 before 16.6.7, 16.7 before 16.7.5, and 16.8 before 16.8.2. The vulnerable GraphQL `vulnerabilitiesCountByDay` path can impact availability with low attack complexity and authenticated access.
Likely exposure
Exposure is most relevant for self-managed GitLab EE instances in the affected version ranges, especially instances reachable by many authenticated users or external collaborators.
Exploitation context
The source bundle does not show CISA KEV listing or other cited evidence of active exploitation. The CVSS vector indicates network access, low complexity, low privileges, no user interaction, and high availability impact.
Researcher notes
The public bundle identifies the affected GraphQL field but provides limited implementation detail. Avoid assuming broader GitLab CE impact, unauthenticated exploitability, or active exploitation without additional vendor or KEV evidence.
Mitigation direction
- Upgrade GitLab EE to 16.6.7, 16.7.5, 16.8.2, or a later fixed release.
- Review GitLab Issue #420341 and vendor guidance for any environment-specific notes.
- Prioritize internet-facing or multi-tenant GitLab EE instances first.
- Monitor GitLab resource usage and GraphQL request volume until remediation is complete.
Validation and detection
- Confirm whether the deployment is GitLab EE and record the exact version.
- Compare the version against 13.3.0-16.6.6, 16.7.0-16.7.4, and 16.8.0-16.8.1.
- Review logs or telemetry for unusual GraphQL activity and resource spikes.
- After upgrade, verify the deployed version reports a fixed release or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-770: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2024-1066 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H2.83.6GitLabVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- GitLab Issue #420341CVE reference, GitLab · issue-tracking
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Allocation of Resources Without Limits or Throttling
Allocation of Resources Without Limits or Throttling represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.