CVE-2024-5258
Authorization Bypass Through User-Controlled Key in GitLab
Summary
Authorization Bypass Through User-Controlled Key in GitLab
Original description
The description as published by the source.
An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"16.10.0"},{"fixed":"16.10.6"},{"introduced":"16.11.0"},{"fixed":"16.11.3"},{"introduced":"17.0.0"},{"fixed":"17.0.1"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com