CVE-2024-0456
published 2024-01-26CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able…
PriorityP424medium4.3CVSS 3.1
AVNACLPRLUINSUCNILAN
EPSS
0.49%
38.4th percentile
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | gitlab | < gitlab 16.6.6-1 (sid) | gitlab 16.6.6-1 (sid) |
| gitlab | gitlab | — | — |
| gitlab | gitlab | — | — |
| gitlab | gitlab | >= 14.0 < 16.6.6 | 16.6.6 |
| gitlab | gitlab | >= 14.0.0 < 16.6.6 | 16.6.6 |
| gitlab | gitlab | >= 16.7 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.7.0 < 16.7.4 | 16.7.4 |
| gitlab | gitlab | >= 16.8 < 16.8.1 | 16.8.1 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
osv4.3MEDIUM
vendor_debian4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GitLab
CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacke
vendor_gitlab·2024-01-26·CVSS 4.3
CVE-2024-0456 [MEDIUM] CWE-425 CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacke
CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
Debian
CVE-2024-0456: gitlab - An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 1...
vendor_debian·2024·CVSS 4.3
CVE-2024-0456 [MEDIUM] CVE-2024-0456: gitlab - An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 1...
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
Scope: local
sid: resolved (fixed in 16.6.6-1)
OSV
CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14
osv·2024-01-26·CVSS 4.3
CVE-2024-0456 [MEDIUM] CVE-2024-0456: An authorization vulnerability exists in GitLab versions 14
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
GHSA
GHSA-mr56-56j8-x6r4: An authorization vulnerability exists in GitLab versions 14
ghsa_unreviewed·2024-01-26
CVE-2024-0456 [MEDIUM] CWE-285 GHSA-mr56-56j8-x6r4: An authorization vulnerability exists in GitLab versions 14
An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-01-26
Published