CVE-2024-13041
Incorrect User Management in GitLab
Summary
Incorrect User Management in GitLab
Original description
The description as published by the source.
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"16.4.0"},{"fixed":"17.5.5"},{"introduced":"17.6.0"},{"fixed":"17.6.3"},{"introduced":"17.7.0"},{"fixed":"17.7.1"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com
- web about.gitlab.com