Undergoing Analysis
CVE has been recently published to the CVE List and has been received by the NVD.

Products

GitLab CE/EE

16.1 - 16.11.5

17.0 - 17.0.3

17.1 - 17.1.1

Source

cve@gitlab.com

CVE-2024-4011 details

Published : June 27, 2024, 12:15 a.m.
Last Modified : June 27, 2024, 12:47 p.m.

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows non-project member to promote key results to objectives.

CVSS Score

1	2	3.1	4	5	6	7	8	9	10

Weakness

Weakness	Name	Description
CWE-284	Improper Access Control	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact