CyberzSOC

Publication detail
← Back to advisories & guidance

2024-026: Vulnerabilities in GitLab ↗ source

March 8, 2024 CERT-EU Advisory
Source: https://cert.europa.eu/publications/security-advisories/2024-026/

Summary

CODEOWNERS approval allowing stealing protected variables by utilising a crafted payload in an old feature branch to perform malicious actions. role of manage_group_access_tokens to rotate group access tokens with owner privileges. CERT-EU strongly recommends updating software installations to the latest versions by following the instructions given by the vendor [1].

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVECVSSAffected
CVE-2024-0199 7.7 High GitLab GitLab An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 1…
CVE-2024-1299 6.5 Medium GitLab GitLab A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

GitLab 5 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.