Lucene search

K
osvGoogleOSV:BIT-GITLAB-2024-0199
HistoryMar 12, 2024 - 8:25 a.m.

BIT-gitlab-2024-0199

2024-03-1208:25:54
Google
osv.dev
6
gitlab
authorization bypass
vulnerability
codeowners
attacker

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

6.3 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

15.5%