BIT-gitlab-2024-0456

vendorUSosv

Direct Request ('Forced Browsing') in GitLab

view advisory published 2024-03-06Licence: per source

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-0456US	medium4.3	0.49% (41st)	—	2024-01-26
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary…

references

External citations — patches, advisories, analysis.

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/ADVISORY
https://gitlab.com/gitlab-org/gitlab/-/issues/430726WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-0456WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan