PT-2024-15381 · Gitlab · Gitlab

Ali_Shehab · Published 2024-03-07 · Updated 2024-12-11 · CVE-2024-0199

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab versions 11.3 through 16.7.6 GitLab versions 16.7.6 through 16.8.3 GitLab versions 16.8.3 through 16.9.1

Description An authorization bypass vulnerability was discovered in GitLab, allowing an attacker to bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions. This issue potentially exposes financial data or code. Approximately 509,862 devices are potentially affected, mainly distributed in China and the United States.

Recommendations For GitLab versions 11.3 through 16.7.6, upgrade to version 16.7.7 to patch the vulnerability. For GitLab versions 16.7.6 through 16.8.3, upgrade to version 16.8.4 to patch the vulnerability. For GitLab versions 16.8.3 through 16.9.1, upgrade to version 16.9.2 to patch the vulnerability. As a temporary workaround, consider restricting access to old feature branches to minimize the risk of exploitation.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

BIT-GITLAB-2024-0199

CVE-2024-0199

Affected Products

Gitlab

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0199.json · Exploit
• 🔥 https://hackerone.com/reports/2295423 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/436977 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0199 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-0199 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-0199 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0199 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2024-0199 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-0199 · Vendor Advisory
• https://twitter.com/0xABFF/status/1765867467216220367 · Twitter Post
• https://t.me/cvenotify/73266 · Telegram Post
• https://twitter.com/zoomeye_team/status/1765976457099243660 · Twitter Post
• https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released · Note
• https://twitter.com/cynical_sec/status/1767133451667284469 · Twitter Post
• https://t.me/cvenotify/103925 · Telegram Post