PT-2024-1870 · Gitlab · Gitlab Ce/Ee+1

Them4Les_L1Ron · Published 2024-01-24 · Updated 2024-10-03 · CVE-2024-0861

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 16.4 through 16.7.5 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0

Description An issue has been discovered in GitLab EE, where users with the Guest role can change Custom dashboard projects settings contrary to their permissions. This is related to deficiencies in the authorization procedure, which can be exploited by a remote attacker to modify the custom dashboard projects settings.

Recommendations For GitLab EE versions 16.4 through 16.7.5, update to version 16.7.6 or later. For GitLab EE versions 16.8 through 16.8.2, update to version 16.8.3 or later. For GitLab EE versions 16.9 through 16.9.0, update to version 16.9.1 or later. As a temporary workaround, consider restricting the Guest role's access to the Custom dashboard projects settings until a patch is available.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-425

Related Identifiers

BDU:2024-01632

BIT-GITLAB-2024-0861

CVE-2024-0861

Affected Products

Gitlab

Gitlab Ce/Ee

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0861.json · Exploit
• 🔥 https://hackerone.com/reports/2316435 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-0861 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-0861 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01632 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-0861 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-0861 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-0861 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-0861 · Security Note
• https://t.me/cvenotify/72154 · Telegram Post
• https://vuldb.com/ru/?id.254476 · Note
• https://twitter.com/CVEnew/status/1760452453907267848 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/439240 · Note
• https://t.me/cvenotify/72944 · Telegram Post