PT-2024-1871 · Gitlab · Gitlab

Ali_Shehab · Published 2024-01-11 · Updated 2024-10-03 · CVE-2024-0410

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 15.1 through 16.7.5 GitLab versions 16.8 through 16.8.2 GitLab versions 16.9 through 16.9.0

Description The issue is related to insufficient access control in GitLab, allowing a remote attacker to bypass security restrictions. A developer can bypass CODEOWNERS approvals by creating a merge conflict.

Recommendations For GitLab versions 15.1 through 16.7.5, update to version 16.7.6 or later. For GitLab versions 16.8 through 16.8.2, update to version 16.8.3 or later. For GitLab versions 16.9 through 16.9.0, update to version 16.9.1 or later. As a temporary workaround, consider restricting the ability to create merge conflicts until a patch is available.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

CWE-264

CWE-841

Related Identifiers

BDU:2024-01635

BIT-GITLAB-2024-0410

CVE-2024-0410

Affected Products

Gitlab

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0410.json · Exploit
• 🔥 https://hackerone.com/reports/2296778 · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2024-0410 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-0410 · Security Note
• https://ubuntu.com/security/CVE-2024-0410 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0410 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-0410 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-01635 · Security Note
• https://osv.dev/vulnerability/CVE-2024-0410 · Vendor Advisory
• https://twitter.com/cracbot/status/1760907380844646597 · Twitter Post
• https://t.me/cvenotify/72943 · Telegram Post
• https://about.gitlab.com/releases/2024/02/21/security-release-gitlab-16-9-1-released · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/437988 · Note
• https://vuldb.com/?id.254475 · Note
• https://t.me/cvenotify/72152 · Telegram Post