CVSS: 6.7EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8641 – Privilege Context Switching Error in GitLab
https://notcve.org/view.php?id=CVE-2024-8641
An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It may have been possible for an attacker with a victim's CI_JOB_TOKEN to obtain a GitLab session token belonging to the victim. • https://gitlab.com/gitlab-org/gitlab/-/issues/471954 https://hackerone.com/reports/2595495 • CWE-270: Privilege Context Switching Error •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8631 – Privilege Defined With Unsafe Actions in GitLab
https://notcve.org/view.php?id=CVE-2024-8631
A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles. • https://gitlab.com/gitlab-org/gitlab/-/issues/462665 https://hackerone.com/reports/2478469 • CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8754 – External Control of Critical State Data in GitLab
https://notcve.org/view.php?id=CVE-2024-8754
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured. • https://gitlab.com/gitlab-org/gitlab/-/issues/464062 • CWE-642: External Control of Critical State Data •
CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8635 – Server-Side Request Forgery (SSRF) in GitLab
https://notcve.org/view.php?id=CVE-2024-8635
A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL • https://gitlab.com/gitlab-org/gitlab/-/issues/455273 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2743 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-2743
An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. • https://gitlab.com/gitlab-org/gitlab/-/issues/451014 https://hackerone.com/reports/2411756 • CWE-863: Incorrect Authorization •