PT-2024-39145 · Gitlab · Gitlab Ce/Ee+1

Chotebabume · Published 2024-09-12 · Updated 2024-09-16 · CVE-2024-8631

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 16.6 through 17.1.7 GitLab EE versions 17.2 through 17.2.5 GitLab EE versions 17.3 through 17.3.2

Description: A privilege escalation issue has been discovered in GitLab EE. This issue allows a user assigned the Admin Group Member custom role to escalate their privileges to include other custom roles.

Recommendations: For GitLab EE versions 16.6 through 17.1.7, update to version 17.1.7 or later. For GitLab EE versions 17.2 through 17.2.5, update to version 17.2.5 or later. For GitLab EE versions 17.3 through 17.3.2, update to version 17.3.2 or later. As a temporary workaround, consider restricting the use of the Admin Group Member custom role until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-267

Related Identifiers

BIT-GITLAB-2024-8631

CVE-2024-8631

Affected Products

Gitlab

Gitlab Ce/Ee

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/8xxx/CVE-2024-8631.json · Exploit
• 🔥 https://hackerone.com/reports/2478469 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-8631 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-8631 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8631 · Vendor Advisory
• https://twitter.com/CVEnew/status/1834283740870095172 · Twitter Post
• https://about.gitlab.com/releases/2024/09/11/patch-release-gitlab-17-3-2-released · Note
• https://twitter.com/VulmonFeeds/status/1834311028793897410 · Twitter Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/462665 · Note
• https://t.me/cvenotify/94642 · Telegram Post
• https://twitter.com/cracbot/status/1835921748078026996 · Twitter Post
• https://t.me/cvedetector/5494 · Telegram Post