CVE-2024-1347 - Vulnerability Details

Vendors	Products
Gitlab	Gitlab

Link	Providers
https://gitlab.com/gitlab-org/gitlab/-/issues/441093
https://hackerone.com/reports/2355565
https://nvd.nist.gov/vuln/detail/CVE-2024-1347
https://www.cve.org/CVERecord?id=CVE-2024-1347

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:gitlab:gitlab:::::community:::* cpe:2.3:a:gitlab:gitlab:::::enterprise:::* cpe:2.3:a:gitlab:gitlab:16.11.0::::community::: cpe:2.3:a:gitlab:gitlab:16.11.0::::enterprise:::

Type	Values Removed	Values Added
Title	Improper Authentication in GitLab	Authentication Bypass by Spoofing in GitLab
Weaknesses		CWE-290

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
First Time appeared		Gitlab Gitlab gitlab
CPEs		cpe:2.3:a:gitlab:gitlab::::::::
Vendors & Products		Gitlab Gitlab gitlab

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-1347", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "state": "PUBLISHED", "assignerShortName": "GitLab", "dateReserved": "2024-02-08T12:02:17.525Z", "datePublished": "2024-04-25T11:02:25.923Z", "dateUpdated": "2024-10-03T06:23:18.435Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "GitLab", "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "versions": [{"lessThan": "16.9.6", "status": "affected", "version": "0.0", "versionType": "semver"}, {"lessThan": "16.10.4", "status": "affected", "version": "16.10", "versionType": "semver"}, {"lessThan": "16.11.1", "status": "affected", "version": "16.11", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Thanks [garethheyes](https://hackerone.com/garethheyes) for reporting this vulnerability through our HackerOne bug bounty program"}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-290", "description": "CWE-290: Authentication Bypass by Spoofing", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-10-03T06:23:18.435Z"}, "references": [{"name": "GitLab Issue #441093", "tags": ["issue-tracking", "permissions-required"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093"}, {"name": "HackerOne Bug Bounty Report #2355565", "tags": ["technical-description", "exploit", "permissions-required"], "url": "https://hackerone.com/reports/2355565"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above."}], "title": "Authentication Bypass by Spoofing in GitLab"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-04-29T18:56:32.766362Z", "id": "CVE-2024-1347", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-17T15:34:41.007Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.387Z"}, "title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093", "name": "GitLab Issue #441093", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2355565", "name": "HackerOne Bug Bounty Report #2355565", "tags": ["technical-description", "exploit", "x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-1347 (string)

assignerOrgId : ceab7361-8a18-47b1-92ba-4d7d25f6715a (string)

state : PUBLISHED (string)

assignerShortName : GitLab (string)

dateReserved : 2024-02-08T12:02:17.525Z (string)

datePublished : 2024-04-25T11:02:25.923Z (string)

dateUpdated : 2024-10-03T06:23:18.435Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

product : GitLab (string)

repo : git://git@gitlab.com:gitlab-org/gitlab.git (string)

vendor : GitLab (string)

versions : [ »

0 : { »

lessThan : 16.9.6 (string)

status : affected (string)

version : 0.0 (string)

versionType : semver (string)

}

1 : { »

lessThan : 16.10.4 (string)

status : affected (string)

version : 16.10 (string)

versionType : semver (string)

}

2 : { »

lessThan : 16.11.1 (string)

status : affected (string)

version : 16.11 (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Thanks [garethheyes](https://hackerone.com/garethheyes) for reporting this vulnerability through our HackerOne bug bounty program (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-290 (string)

description : CWE-290: Authentication Bypass by Spoofing (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : ceab7361-8a18-47b1-92ba-4d7d25f6715a (string)

shortName : GitLab (string)

dateUpdated : 2024-10-03T06:23:18.435Z (string)

}

references : [ »

0 : { »

name : GitLab Issue #441093 (string)

tags : [ »

0 : issue-tracking (string)

1 : permissions-required (string)

]

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

}

1 : { »

name : HackerOne Bug Bounty Report #2355565 (string)

tags : [ »

0 : technical-description (string)

1 : exploit (string)

2 : permissions-required (string)

]

url : https://hackerone.com/reports/2355565 (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above. (string)

}

]

title : Authentication Bypass by Spoofing in GitLab (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-04-29T18:56:32.766362Z (string)

id : CVE-2024-1347 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-17T15:34:41.007Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:33:25.387Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

name : GitLab Issue #441093 (string)

tags : [ »

0 : issue-tracking (string)

1 : permissions-required (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://hackerone.com/reports/2355565 (string)

name : HackerOne Bug Bounty Report #2355565 (string)

tags : [ »

0 : technical-description (string)

1 : exploit (string)

2 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093", "name": "GitLab Issue #441093", "tags": ["issue-tracking", "permissions-required", "x_transferred"]}, {"url": "https://hackerone.com/reports/2355565", "name": "HackerOne Bug Bounty Report #2355565", "tags": ["technical-description", "exploit", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:33:25.387Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-1347", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-04-29T18:56:32.766362Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-29T18:56:02.968Z"}}], "cna": {"title": "Improper Authentication in GitLab", "credits": [{"lang": "en", "type": "finder", "value": "Thanks [garethheyes](https://hackerone.com/garethheyes) for reporting this vulnerability through our HackerOne bug bounty program"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"], "repo": "git://git@gitlab.com:gitlab-org/gitlab.git", "vendor": "GitLab", "product": "GitLab", "versions": [{"status": "affected", "version": "0.0", "lessThan": "16.9.6", "versionType": "semver"}, {"status": "affected", "version": "16.10", "lessThan": "16.10.4", "versionType": "semver"}, {"status": "affected", "version": "16.11", "lessThan": "16.11.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above."}], "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093", "name": "GitLab Issue #441093", "tags": ["issue-tracking", "permissions-required"]}, {"url": "https://hackerone.com/reports/2355565", "name": "HackerOne Bug Bounty Report #2355565", "tags": ["technical-description", "exploit", "permissions-required"]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "CWE-287: Improper Authentication"}]}], "providerMetadata": {"orgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "shortName": "GitLab", "dateUpdated": "2024-09-18T04:09:20.182Z"}}}, "cveMetadata": {"cveId": "CVE-2024-1347", "state": "PUBLISHED", "dateUpdated": "2024-09-18T04:09:20.182Z", "dateReserved": "2024-02-08T12:02:17.525Z", "assignerOrgId": "ceab7361-8a18-47b1-92ba-4d7d25f6715a", "datePublished": "2024-04-25T11:02:25.923Z", "assignerShortName": "GitLab"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

name : GitLab Issue #441093 (string)

tags : [ »

0 : issue-tracking (string)

1 : permissions-required (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://hackerone.com/reports/2355565 (string)

name : HackerOne Bug Bounty Report #2355565 (string)

tags : [ »

0 : technical-description (string)

1 : exploit (string)

2 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:33:25.387Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-1347 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-04-29T18:56:32.766362Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-04-29T18:56:02.968Z (string)

}

]

cna : { »

title : Improper Authentication in GitLab (string)

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Thanks [garethheyes](https://hackerone.com/garethheyes) for reporting this vulnerability through our HackerOne bug bounty program (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:* (string)

]

repo : git://git@gitlab.com:gitlab-org/gitlab.git (string)

vendor : GitLab (string)

product : GitLab (string)

versions : [ »

0 : { »

status : affected (string)

version : 0.0 (string)

lessThan : 16.9.6 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 16.10 (string)

lessThan : 16.10.4 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 16.11 (string)

lessThan : 16.11.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

value : Upgrade to versions 16.9.6, 16.10.4, 16.11.1 or above. (string)

}

]

references : [ »

0 : { »

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

name : GitLab Issue #441093 (string)

tags : [ »

0 : issue-tracking (string)

1 : permissions-required (string)

]

}

1 : { »

url : https://hackerone.com/reports/2355565 (string)

name : HackerOne Bug Bounty Report #2355565 (string)

tags : [ »

0 : technical-description (string)

1 : exploit (string)

2 : permissions-required (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-287 (string)

description : CWE-287: Improper Authentication (string)

}

]

}

]

providerMetadata : { »

orgId : ceab7361-8a18-47b1-92ba-4d7d25f6715a (string)

shortName : GitLab (string)

dateUpdated : 2024-09-18T04:09:20.182Z (string)

}

cveMetadata : { »

cveId : CVE-2024-1347 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-18T04:09:20.182Z (string)

dateReserved : 2024-02-08T12:02:17.525Z (string)

assignerOrgId : ceab7361-8a18-47b1-92ba-4d7d25f6715a (string)

datePublished : 2024-04-25T11:02:25.923Z (string)

assignerShortName : GitLab (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "2F0F0583-C3CF-434F-8ECF-5435FFC123FC", "versionEndExcluding": "16.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "9D88BF7B-8341-48C7-95B9-570908BC0898", "versionEndExcluding": "16.9.6", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "matchCriteriaId": "A56BDD5E-E19A-4C96-BFA1-0C9C714BC1DF", "versionEndExcluding": "16.10.4", "versionStartIncluding": "16.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "matchCriteriaId": "4DFA9764-53C9-46A5-904A-109E64CF5942", "versionEndExcluding": "16.10.4", "versionStartIncluding": "16.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:16.11.0:*:*:*:community:*:*:*", "matchCriteriaId": "DBAF6CB8-EEBE-4F61-9B80-165C351748E2", "vulnerable": true}, {"criteria": "cpe:2.3:a:gitlab:gitlab:16.11.0:*:*:*:enterprise:*:*:*", "matchCriteriaId": "BEF58721-8679-4EA5-A353-4ED035241169", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.9.6, todas las versiones desde 16.10 anteriores a 16.10.4, todas las versiones desde 16.11 anteriores a 16.11.1. Bajo ciertas condiciones, un atacante a trav\u00e9s de una direcci\u00f3n de correo electr\u00f3nico manipulada puede eludir las restricciones basadas en el dominio en una instancia o grupo."}], "id": "CVE-2024-1347", "lastModified": "2024-12-11T19:24:26.643", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "cve@gitlab.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-04-25T11:15:45.637", "references": [{"source": "cve@gitlab.com", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093"}, {"source": "cve@gitlab.com", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2355565"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/441093"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Permissions Required"], "url": "https://hackerone.com/reports/2355565"}], "sourceIdentifier": "cve@gitlab.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-290"}], "source": "cve@gitlab.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* (string)

matchCriteriaId : 2F0F0583-C3CF-434F-8ECF-5435FFC123FC (string)

versionEndExcluding : 16.9.6 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 9D88BF7B-8341-48C7-95B9-570908BC0898 (string)

versionEndExcluding : 16.9.6 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* (string)

matchCriteriaId : A56BDD5E-E19A-4C96-BFA1-0C9C714BC1DF (string)

versionEndExcluding : 16.10.4 (string)

versionStartIncluding : 16.10.0 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : 4DFA9764-53C9-46A5-904A-109E64CF5942 (string)

versionEndExcluding : 16.10.4 (string)

versionStartIncluding : 16.10.0 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:gitlab:gitlab:16.11.0:*:*:*:community:*:*:* (string)

matchCriteriaId : DBAF6CB8-EEBE-4F61-9B80-165C351748E2 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:gitlab:gitlab:16.11.0:*:*:*:enterprise:*:*:* (string)

matchCriteriaId : BEF58721-8679-4EA5-A353-4ED035241169 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. (string)

}

1 : { »

lang : es (string)

value : Se descubrió un problema en GitLab CE/EE que afecta a todas las versiones anteriores a 16.9.6, todas las versiones desde 16.10 anteriores a 16.10.4, todas las versiones desde 16.11 anteriores a 16.11.1. Bajo ciertas condiciones, un atacante a través de una dirección de correo electrónico manipulada puede eludir las restricciones basadas en el dominio en una instancia o grupo. (string)

}

]

id : CVE-2024-1347 (string)

lastModified : 2024-12-11T19:24:26.643 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : cve@gitlab.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 1.4 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-04-25T11:15:45.637 (string)

references : [ »

0 : { »

source : cve@gitlab.com (string)

tags : [ »

0 : Broken Link (string)

]

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

}

1 : { »

source : cve@gitlab.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://hackerone.com/reports/2355565 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Broken Link (string)

]

url : https://gitlab.com/gitlab-org/gitlab/-/issues/441093 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://hackerone.com/reports/2355565 (string)

}

]

sourceIdentifier : cve@gitlab.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-290 (string)

}

]

source : cve@gitlab.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "gitlab: bypass domain based restrictions on an instance or a group by a crafted email", "id": "2277132", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2277132"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-287", "details": ["An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group.", "A flaw was found in GitLab CE/EE. Under certain conditions, an attacker, through a crafted email address, can bypass domain-based restrictions on an instance or a group. This issue affects all versions through 16.9.6, 16.10 through 16.10.4, and 16.11 through 16.11.1."], "name": "CVE-2024-1347", "package_state": [{"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Will not fix", "package_name": "openshift4/ose-console", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2024-04-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-1347\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-1347\nhttps://gitlab.com/gitlab-org/gitlab/-/issues/441093\nhttps://hackerone.com/reports/2355565"], "threat_severity": "Moderate"}

{

bugzilla : { »

description : gitlab: bypass domain based restrictions on an instance or a group by a crafted email (string)

id : 2277132 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2277132 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 4.3 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N (string)

status : draft (string)

}

cwe : CWE-287 (string)

details : [ »

0 : An issue has been discovered in GitLab CE/EE affecting all versions before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker through a crafted email address may be able to bypass domain based restrictions on an instance or a group. (string)

1 : A flaw was found in GitLab CE/EE. Under certain conditions, an attacker, through a crafted email address, can bypass domain-based restrictions on an instance or a group. This issue affects all versions through 16.9.6, 16.10 through 16.10.4, and 16.11 through 16.11.1. (string)

]

name : CVE-2024-1347 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:openshift:4 (string)

fix_state : Will not fix (string)

package_name : openshift4/ose-console (string)

product_name : Red Hat OpenShift Container Platform 4 (string)

}

]

public_date : 2024-04-25T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2024-1347 https://nvd.nist.gov/vuln/detail/CVE-2024-1347 https://gitlab.com/gitlab-org/gitlab/-/issues/441093 https://hackerone.com/reports/2355565 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object