CVE-2024-5258
Assigner: GitLab
Published: 2024-05-23T11:02:06.904Z
State: PUBLISHED
title: Authorization Bypass Through User-Controlled Key in GitLab
descriptions: value: An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 16.10
status: affected
lessThan: 16.10.6
versionType: semver
version: 16.11
status: affected
lessThan: 16.11.3
versionType: semver
version: 17.0
status: affected
lessThan: 17.0.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-639: Authorization Bypass Through User-Controlled Key
cweId: CWE-639
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 4.4
baseSeverity: MEDIUM
solutions: value: Upgrade to versions 16.10.6, 16.11.3, 17.0.1 or above
credits: value: Thanks to GitLab Team Member, Andrew Winata for reporting this issue
type: finder