MEDIUM🇵🇱 Wersja polska

CVE-2024-1250

CVSS 6.5v3.1pub. 2024-02-12upd. 2024-11-21

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to create group access tokens with Owner privileges, which may lead to privilege escalation.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

  • GitLab

    APP
    Gitlab
    16.8.0 – 16.8.2 (bez)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
LPECI/CD
CWE
References

Related vulnerabilities

CVE-2023-7028CRITICAL10.0⚠ KEVPL ✓ten sam produkt

GitLab: Przejęcie konta przez reset hasła na niezweryfikowany e-mail

CVE-2021-22205CRITICAL10.0⚠ KEVten sam produkt

An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.9. GitLab was not properl...

CVE-2024-7102CRITICAL9.6PL ✓ten sam produkt

GitLab CE/EE: uruchomienie pipeline jako inny użytkownik (privilege escalation)

CVE-2024-9164CRITICAL9.6PL ✓ten sam produkt

GitLab EE: uruchamianie pipeline CI/CD na dowolnych gałęziach bez autoryzacji

CVE-2024-6678CRITICAL9.9PL ✓ten sam produkt

GitLab CE/EE — uruchomienie pipeline jako dowolny użytkownik (CWE-290)