CVE-2024-5470 Improper Access Control in GitLab

2024-07-1106:57:04

CWE-284

GitLab

www.cve.org

gitlab

access control

cve-2024-5470

admin permission

deploy tokens

CVSS3

3.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

EPSS

Percentile

14.3%

JSON

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with admin_push_rules permission may have been able to create project-level deploy tokens.

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "GitLab",
    "repo": "git://[email protected]:gitlab-org/gitlab.git",
    "vendor": "GitLab",
    "versions": [
      {
        "lessThan": "17.0.4",
        "status": "affected",
        "version": "17.0",
        "versionType": "semver"
      },
      {
        "lessThan": "17.1.2",
        "status": "affected",
        "version": "17.1",
        "versionType": "semver"
      }
    ]
  }
]