CVE-2024-3127
EUVD-2024-3172822.08.2024, 16:15
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 12.5.0 ≤ 𝑥 < 17.1.6 |
| gitlab | gitlab | 12.5.0 ≤ 𝑥 < 17.1.6 |
| gitlab | gitlab | 17.2.0 ≤ 𝑥 < 17.2.4 |
| gitlab | gitlab | 17.2.0 ≤ 𝑥 < 17.2.4 |
| gitlab | gitlab | 17.3.0 |
| gitlab | gitlab | 17.3.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-284 - Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.