CVE-2024-5258
EUVD-2024-4649623.05.2024, 11:15
An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| gitlab | gitlab | 16.10.0 ≤ 𝑥 < 16.10.6 |
| gitlab | gitlab | 16.10.0 ≤ 𝑥 < 16.10.6 |
| gitlab | gitlab | 16.11.0 ≤ 𝑥 < 16.11.3 |
| gitlab | gitlab | 16.11.0 ≤ 𝑥 < 16.11.3 |
| gitlab | gitlab | 17.0.0 |
| gitlab | gitlab | 17.0.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-639 - Authorization Bypass Through User-Controlled KeyThe system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- CWE-863 - Incorrect AuthorizationThe software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.