GitLab Authorization Bypass Vulnerability Affects Multiple Versions

CVE-2024-0410
7.7HIGH

Key Information

Vendor
Gitlab
Status
Gitlab
Vendor
CVE Published:
22 February 2024

Summary

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

Affected Version(s)

GitLab < 16.7.6

GitLab < 16.8.3

GitLab < 16.9.1

CVSS V3.1

Score:
7.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published.

  • Vulnerability Reserved.

Collectors

NVD DatabaseMitre Database

Credit

Thanks [ali_shehab](https://hackerone.com/ali_shehab) for reporting this vulnerability through our HackerOne bug bounty program
.