CVE-2024-1347
Authentication Bypass by Spoofing in GitLab
Summary
Authentication Bypass by Spoofing in GitLab
Original description
The description as published by the source.
An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"16.9.6"},{"introduced":"16.10.0"},{"fixed":"16.10.4"},{"introduced":"16.11.0"},{"fixed":"16.11.1"}]}]
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Ubuntu UBUNTU-CVE-2024-1347 gitlab
References
- web gitlab.com
- web hackerone.com
- web nvd.nist.gov