CVE-2024-0456

Direct Request ('Forced Browsing') in GitLab

概要

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"14.0.0"},{"fixed":"16.6.6"},{"introduced":"16.7.0"},{"fixed":"16.7.4"},{"introduced":"16.8.0"},{"fixed":"16.8.1"}]}]

参照URL

advisory about.gitlab.com
web gitlab.com
web nvd.nist.gov