CVE-2024-0456

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-0456
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/430726 Broken Link
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/430726 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:*
History

21 Nov 2024, 08:46

Type Values Removed Values Added
References () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - Vendor Advisory () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/issues/430726 - Broken Link () https://gitlab.com/gitlab-org/gitlab/-/issues/430726 - Broken Link
Summary (en) An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project (en) An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

03 Oct 2024, 07:15

Type Values Removed Values Added
CWE CWE-285 CWE-425

31 Jan 2024, 20:12

Type Values Removed Values Added
First Time Gitlab
Gitlab gitlab
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:16.8.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
CWE NVD-CWE-Other
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.3
References () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - () https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ - Vendor Advisory
References () https://gitlab.com/gitlab-org/gitlab/-/issues/430726 - () https://gitlab.com/gitlab-org/gitlab/-/issues/430726 - Broken Link

26 Jan 2024, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-26 01:15

Updated : 2024-11-21 08:46

NVD link : CVE-2024-0456

Mitre link : CVE-2024-0456

CVE.ORG link : CVE-2024-0456

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-425

Direct Request ('Forced Browsing')

NVD-CWE-Other