CVE-2024-5258
Authorization Bypass Through User-Controlled Key in GitLab
Résumé
Authorization Bypass Through User-Controlled Key in GitLab
Description d'origine
La description telle que publiée par la source (souvent en anglais).
An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.
Paquets affectés
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"16.10.0"},{"fixed":"16.10.6"},{"introduced":"16.11.0"},{"fixed":"16.11.3"},{"introduced":"17.0.0"},{"fixed":"17.0.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com