PT-2024-7876 · Gitlab · Gitlab Ce/Ee+1
Yvvdwf
·
Published
2024-08-29
·
Updated
2024-09-18
·
CVE-2024-8641
CVSS v2.0
9.0
High
| Vector | AV:N/AC:L/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
GitLab CE/EE versions 13.7 through 17.1.7
GitLab CE/EE versions 17.2 through 17.2.5
GitLab CE/EE versions 17.3 through 17.3.2
Description
An issue has been discovered in GitLab CE/EE that may have allowed an attacker with a victim's CI JOB TOKEN to obtain a GitLab session token belonging to the victim. The vulnerability is related to errors in privilege context switching, which could allow a remote attacker to elevate their privileges and gain unauthorized access to protected information.
Recommendations
For GitLab CE/EE versions 13.7 through 17.1.7, update to version 17.1.7 or later.
For GitLab CE/EE versions 17.2 through 17.2.5, update to version 17.2.5 or later.
For GitLab CE/EE versions 17.3 through 17.3.2, update to version 17.3.2 or later.
As a temporary workaround, consider restricting access to CI JOB TOKEN to minimize the risk of exploitation.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitlab
Gitlab Ce/Ee