PT-2024-5146 · Gitlab+1 · Gitlab Ce/Ee+2

Bogdan Denkovych · Published 2024-04-24 · Updated 2024-12-12 · CVE-2024-4024

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 7.8 through 16.9.5 GitLab CE/EE versions 16.10 through 16.10.3 GitLab CE/EE versions 16.11 through 16.11.0

Description: An issue has been discovered in GitLab CE/EE that affects the control of access when Bitbucket is used as an OAuth 2.0 provider. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account.

Recommendations: For versions 7.8 through 16.9.5, update to version 16.9.6 or later. For versions 16.10 through 16.10.3, update to version 16.10.4 or later. For versions 16.11 through 16.11.0, update to version 16.11.1 or later. As a temporary workaround, consider restricting the use of Bitbucket as an OAuth 2.0 provider on GitLab until a patch is applied.

Exploit

Fix

Improper Authentication

Improper Access Control

Weakness Enumeration

CWE-302

CWE-287

CWE-284

Related Identifiers

BDU:2024-05693

BIT-GITLAB-2024-4024

CVE-2024-4024

Affected Products

Bitbucket

Gitlab

Gitlab Ce/Ee

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4024.json · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/452426 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4024 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-4024 · Security Note
• https://ubuntu.com/security/CVE-2024-4024 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4024 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-4024 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4024 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05693 · Security Note
• https://about.gitlab.com/releases/2024/04/24/patch-release-gitlab-16-11-1-released · Note
• https://t.me/cvenotify/78031 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2024042510 · Note
• https://t.me/cvenotify/78018 · Telegram Post
• https://vuldb.com/ru/?id.262016 · Note
• https://t.me/cvenotify/104066 · Telegram Post