← Back

CVE-2024-1299

nvd nist
Published: Mar 7, 2024Modified: Jun 17, 2026

JSON object

Loading...
8.1
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Exploitability: 2.8 / Impact: 5.2
Source: NVD

Description

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

Affected (4)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
4 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.8.0 to 16.8.4
Gitlab
From 16.9.0 to 16.9.2
Gitlab
From 16.8.0 to 16.8.4
Gitlab
From 16.9.0 to 16.9.2

Related CWEs

CWE-268
Privilege Chaining
Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform unsafe actions that would not be allowed without that combination.

References (6)

Source: cve@gitlab.com
Release Notes
Source: cve@gitlab.com
ExploitIssue Tracking
Source: cve@gitlab.com
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Release Notes
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue Tracking
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required

Timeline

No history available yet.