Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-1299

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

Published

2024-03-07T01:15:52.443

Last Modified

2024-12-11T20:23:27.497

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 6.5 (MEDIUM)

Weaknesses

Type: Secondary
CWE-268
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	gitlab	gitlab	< 16.8.4	Yes
Application	gitlab	gitlab	< 16.8.4	Yes
Application	gitlab	gitlab	< 16.9.2	Yes
Application	gitlab	gitlab	< 16.9.2	Yes

References

https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/ Release Notes ([email protected])
https://gitlab.com/gitlab-org/gitlab/-/issues/440745 Exploit, Issue Tracking ([email protected])
https://hackerone.com/reports/2356976 Permissions Required ([email protected])
https://about.gitlab.com/releases/2024/03/06/security-release-gitlab-16-9-2-released/ Release Notes (af854a3a-2127-422b-91ae-364da2661108)
https://gitlab.com/gitlab-org/gitlab/-/issues/440745 Exploit, Issue Tracking (af854a3a-2127-422b-91ae-364da2661108)
https://hackerone.com/reports/2356976 Permissions Required (af854a3a-2127-422b-91ae-364da2661108)