PT-2024-6746 · Gitlab · Gitlab Ce/Ee+1

Ashish + 1 · Published 2024-04-19 · Updated 2024-08-30 · CVE-2024-4011

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1 through 16.11.5 GitLab CE/EE versions 17.0 through 17.0.3 GitLab CE/EE versions 17.1 through 17.1.1

Description: The issue is related to inadequate access control in GitLab, a collaborative coding platform. It allows a non-project member to promote key results to objectives, potentially leading to unauthorized access to protected information.

Recommendations: For versions 16.1 through 16.11.5, update to version 16.11.5 or later. For versions 17.0 through 17.0.3, update to version 17.0.3 or later. For versions 17.1 through 17.1.1, update to version 17.1.1 or later.

Exploit

Fix

Improper Access Control

Improper Privilege Management

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-269

CWE-264

CWE-863

Related Identifiers

BDU:2024-07959

BIT-GITLAB-2024-4011

CVE-2024-4011

Affected Products

Gitlab

Gitlab Ce/Ee

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4011.json · Exploit
• 🔥 https://hackerone.com/reports/2456186 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-4011 · Security Note
• https://osv.dev/vulnerability/BIT-gitlab-2024-4011 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-4011 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-4011 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4011 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-4011 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07959 · Security Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/457235 · Note
• https://github.com/advisories/GHSA-3492-v7j6-2xgv · Note
• https://cybersecurity-help.cz/vdb/SB2024062719 · Note
• https://t.me/cvenotify/92823 · Telegram Post
• https://ogma.in/cve-2024-4011-addressing-improper-access-control-in-gitlab · Note
• https://vuldb.com/?id.269784 · Note