Guest Users May Have Been Able to Create Project-Level Deploy Tokens

CVE-2024-5470

3.8LOW

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 11 July 2024

Summary

An issue was discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.0.4 and from 17.1 prior to 17.1.2 where a Guest user with `admin_push_rules` permission may have been able to create project-level deploy tokens.

Affected Version(s)

GitLab < 17.0.4

GitLab < 17.1.2

CVSS V3.1

Score:

3.8

Severity:

LOW

Confidentiality:

Low

Integrity:

Low

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

High

User Interaction:

None

Scope:

Unchanged

Timeline

Risk change from: 2.7 to: 3.8 - (LOW)
Aug 29, 2024
Vulnerability published.
Jul 11, 2024
Vulnerability Reserved.
May 29, 2024

Collectors

NVD DatabaseMitre Database

Credit

Thanks [indoappsec](https://hackerone.com/indoappsec) for reporting this vulnerability through our HackerOne bug bounty program