CVE-2024-5258

May 23, 2024, 11:15 a.m.

CVSS Score

4.4 / 10

Product(s) Impacted

GitLab

16.10 - 16.10.6
16.11 - 16.11.3
17.0 - 17.0.1

Description

An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

Weaknesses

Date

Published: May 23, 2024, 11:15 a.m.

Last Modified: May 23, 2024, 11:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@gitlab.com

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

Base Score

4.4

Exploitability Score

Impact Score

Base Severity

MEDIUM

CVSS Vector String

The CVSS vector string provides an in-depth view of the vulnerability metrics.

View Vector String

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

References

https://gitlab.com/gitlab-org/gitlab/-/issues/443254