CVE-2024-13041: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7…

PriorityP430medium5.4CVSS 3.1

AVNACLPRLUINSUCLILAN

EPSS

0.27%

19.0th percentile

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 17.5.5-1 (sid)	gitlab 17.5.5-1 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	>= 16.4 < 17.5.5	17.5.5
gitlab	gitlab	>= 16.4.0 < 17.5.5	17.5.5
gitlab	gitlab	>= 17.6 < 17.6.3	17.6.3
gitlab	gitlab	>= 17.6.0 < 17.6.3	17.6.3
gitlab	gitlab	>= 17.7 < 17.7.1	17.7.1
gitlab	gitlab	>= 17.7.0 < 17.7.1	17.7.1
gitlab	gitlab_ce	—	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

osv5.4MEDIUM

vendor_debian4.2MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.