A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.
History

Wed, 11 Dec 2024 20:45:00 +0000

Type Values Removed Values Added
Weaknesses NVD-CWE-noinfo
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*

Mon, 07 Oct 2024 19:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Thu, 03 Oct 2024 07:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-863

Thu, 03 Oct 2024 06:30:00 +0000

Type Values Removed Values Added
Title Incorrect Authorization in GitLab Privilege Chaining in GitLab
Weaknesses CWE-268

Thu, 29 Aug 2024 15:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitlab
Gitlab gitlab
CPEs cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
Vendors & Products Gitlab
Gitlab gitlab

cve-icon MITRE

Status: PUBLISHED

Assigner: GitLab

Published: 2024-03-07T00:39:45.501Z

Updated: 2024-10-03T06:23:18.349Z

Reserved: 2024-02-07T06:02:37.306Z

Link: CVE-2024-1299

cve-icon Vulnrichment

Updated: 2024-08-01T18:33:25.390Z

cve-icon NVD

Status : Analyzed

Published: 2024-03-07T01:15:52.443

Modified: 2024-12-11T20:23:27.497

Link: CVE-2024-1299

cve-icon Redhat

No data.