Lucene search

PRIOn knowledge basePRION:CVE-2024-1525

HistoryFeb 22, 2024 - 12:15 a.m.

Default credentials

2024-02-2200:15:00

PRIOn knowledge base

www.prio-n.com

default credentials

gitlab

ldap

vulnerability

version 16.1

version 16.7.6

version 16.8.3

version 16.9.1

secondary email

direct authentication

password reset

nvd

7.1 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

16.1%

JSON

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.

CPENameOperatorVersion
gitlabeq16.9.0
gitlabge16.8
gitlablt16.8.3
gitlabge16.1
gitlablt16.7.6

Name	Operator	Version
gitlab	eq	16.9.0
gitlab	ge	16.8
gitlab	lt	16.8.3
gitlab	ge	16.1
gitlab	lt	16.7.6

References

gitlab.com/gitlab-org/gitlab/-/issues/438144