Main Vulnerability Database Vulnerabilities #VU100973

Missing Authorization in Gitlab Community Edition and GitLab Enterprise Edition - CVE-2024-8114

Published: November 27, 2024

Vulnerability identifier: #VU100973

CSH Severity: Medium

CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-8114

CWE-ID: CWE-862

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote user to escalate privileges on the system.

The vulnerability exists due to missing authorization within LFS Tokens, which leads to security restrictions bypass and privilege escalation.

Gitlab Community Edition
GitLab Enterprise Edition

Install updates from vendor's website.

Gitlab Community Edition - addressed in versions 17.4.5, 17.5.3, 17.6.1
GitLab Enterprise Edition - addressed in versions 17.4.5, 17.5.3, 17.6.1