CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 1CVE-2024-8631 – Privilege Defined With Unsafe Actions in GitLab
https://notcve.org/view.php?id=CVE-2024-8631
A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could have escalated their privileges to include other custom roles. • https://gitlab.com/gitlab-org/gitlab/-/issues/462665 https://hackerone.com/reports/2478469 • CWE-267: Privilege Defined With Unsafe Actions •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8754 – External Control of Critical State Data in GitLab
https://notcve.org/view.php?id=CVE-2024-8754
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured. • https://gitlab.com/gitlab-org/gitlab/-/issues/464062 • CWE-642: External Control of Critical State Data •
CVSS: 7.7EPSS: 0%CPEs: 3EXPL: 0CVE-2024-8635 – Server-Side Request Forgery (SSRF) in GitLab
https://notcve.org/view.php?id=CVE-2024-8635
A server-side request forgery issue has been discovered in GitLab EE affecting all versions starting from 16.8 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. It was possible for an attacker to make requests to internal resources using a custom Maven Dependency Proxy URL • https://gitlab.com/gitlab-org/gitlab/-/issues/455273 • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 1CVE-2024-2743 – Incorrect Authorization in GitLab
https://notcve.org/view.php?id=CVE-2024-2743
An issue was discovered in GitLab-EE starting with version 13.3 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2 that would allow an attacker to modify an on-demand DAST scan without permissions and leak variables. • https://gitlab.com/gitlab-org/gitlab/-/issues/451014 https://hackerone.com/reports/2411756 • CWE-863: Incorrect Authorization •
CVSS: 6.4EPSS: 0%CPEs: 3EXPL: 1CVE-2024-4612 – URL Redirection to Untrusted Site ('Open Redirect') in GitLab
https://notcve.org/view.php?id=CVE-2024-4612
An issue has been discovered in GitLab EE affecting all versions starting from 12.9 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow. • https://gitlab.com/gitlab-org/gitlab/-/issues/460707 https://hackerone.com/reports/2479857 • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •