Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-0410

HistoryFeb 22, 2024 - 12:15 a.m.

CVE-2024-0410

2024-02-2200:15:51

Debian Security Bug Tracker

security-tracker.debian.org

gitlab

authorization bypass

cve-2024-0410

merge conflict

versions 15.1-16.7.6

versions 16.8-16.8.3

versions 16.9-16.9.1

developer

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

JSON

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

OSVersionArchitecturePackageVersionFilename
Debian999allgitlab< 16.8.3-1gitlab_16.8.3-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	999	all	gitlab	< 16.8.3-1	gitlab_16.8.3-1_all.deb

7.7 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

30.0%

JSON

Related for DEBIANCVE:CVE-2024-0410