CVE-2024-2880 - Improper Access Control in GitLab

Back Back to CVE browser

LOW

Improper Access Control in GitLab

Published Jul 11, 2024

2.7

LOW

CVSS 3.1

EPSS 0.35%

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with `admin_group_member` custom role permission could ban group members.

Affected products

Vendor GitLab Product GitLab Default
unaffected
- Version
  16.5
  Status
  affected
  Constraints
  <16.11.6
- Version
  17.0
  Status
  affected
  Constraints
  <17.0.4
- Version
  17.1
  Status
  affected
  Constraints
  <17.1.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

unaffected

Version	Status	Constraints
16.5	affected	<16.11.6
17.0	affected	<17.0.4
17.1	affected	<17.1.2

Remediation

Vendor solution

Upgrade to versions 16.11.6, 17.0.4, 17.1.2 or above.

Weaknesses (1)

CWE-284

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27824
Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/451921
issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2431597
technical-descriptionexploitpermissions-requiredPermissions Required

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-27824		Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/451921		issue-trackingpermissions-requiredBroken Link
https://hackerone.com/reports/2431597		technical-descriptionexploitpermissions-requiredPermissions Required