CVE-2024-1539 — Missing Authorization in Gitlab

CWE-862 — Missing AuthorizationCWE-121 — Stack-based Buffer OverflowCWE-1321 — Prototype Pollution6 documents6 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 87.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GitlabJsonataDebian Gitlab+1 more
Timeline
PublishedFeb 5

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. It was possible to disclose updates to issues to a banned group member using the API.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages6 packages

▶CVEListV5gitlab/gitlab15.2 — 16.9.7+2
▶NVDgitlab/gitlab15.2.0 — 16.9.7+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-4rf9-gv7f-cc74: An issue has been discovered in GitLab EE affecting all versions starting from 15↗2025-02-05
▶
GHSA
JSONata expression can pollute the "Object" prototype↗2024-03-04
▶

📋Vendor Advisories

3
GitLab
CVE-2024-1539: An issue has been discovered in GitLab EE affecting all versions starting from 15.2 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and startin↗2025-02-05
▶
Red Hat
kernel: netfilter: nf_tables: prefer nft_chain_validate↗2024-07-29
▶
Debian
CVE-2024-1539: gitlab - An issue has been discovered in GitLab EE affecting all versions starting from 1...↗2024
▶