Vulnerability · Published Mar 7, 2024 · Assigned by GitLab
CVE-2024-0199Incorrect Authorization in GitLab
High 7.7
In plain English
A high-severity incorrect authorization in GitLab from GitLab. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.7%top 46.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
References
- GitLab Issue #436977 issue-tracking, permissions-required
- HackerOne Bug Bounty Report #2295423 technical-description, exploit, permissions-required
- https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/