← Back

CVE-2024-6685

nvd nist
Published: Sep 16, 2024Modified: Sep 24, 2024

JSON object

Loading...
4.3
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Exploitability: 2.8 / Impact: 1.4
Source: NVD

Description

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.

Affected (6)

Products: Gitlab: Gitlab
Gitlab
1 product
Gitlab
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Gitlab
Gitlab
From 16.7.0 to 17.1.7
Gitlab
From 17.2.0 to 17.2.5
Gitlab
From 17.3.0 to 17.3.2
Gitlab
From 16.7.0 to 17.1.7
Gitlab
From 17.2.0 to 17.2.5
Gitlab
From 17.3.0 to 17.3.2

Related CWEs

CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

Source: cve@gitlab.com
Broken Link
Source: cve@gitlab.com
Permissions Required

Timeline

No history available yet.