CVE-2024-0861 Improper Authorization in GitLab

2024-02-2123:30:39

CWE-285

GitLab

www.cve.org

cve-2024-0861

gitlab

improper authorization

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

Percentile

14.0%

JSON

An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the Guest role can change Custom dashboard projects settings contrary to permissions.

CNA Affected

[
  {
    "vendor": "GitLab",
    "product": "GitLab",
    "repo": "git://[email protected]:gitlab-org/gitlab.git",
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "versions": [
      {
        "version": "16.9",
        "status": "affected",
        "lessThan": "16.9.1",
        "versionType": "semver"
      },
      {
        "version": "16.8",
        "status": "affected",
        "lessThan": "16.8.3",
        "versionType": "semver"
      },
      {
        "version": "16.4",
        "status": "affected",
        "lessThan": "16.7.6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]