PT-2024-17852 · Gitlab · Gitlab

Ashish + 1 · Published 2024-03-07 · Updated 2024-12-11 · CVE-2024-1299

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 16.8 prior to 16.8.4 GitLab versions 16.9 prior to 16.9.2

Description A privilege escalation issue was discovered in GitLab. It was possible for a user with a custom role of manage group access tokens to rotate group access tokens with owner privileges.

Recommendations For GitLab versions 16.8 prior to 16.8.4, update to version 16.8.4 or later. For GitLab versions 16.9 prior to 16.9.2, update to version 16.9.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-268

Related Identifiers

BIT-GITLAB-2024-1299

CVE-2024-1299

Affected Products

Gitlab

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1299.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/440745 · Exploit
• 🔥 https://hackerone.com/reports/2356976 · Exploit
• https://cve.org/CVERecord?id=CVE-2024-1299 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-1299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-1299 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2024-1299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1299 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1299 · Vendor Advisory
• https://t.me/cvenotify/103926 · Telegram Post
• https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released · Note
• https://t.me/cvenotify/73267 · Telegram Post