Gitlab · Gitlab Ce/Ee · CVE-2024-8631
Name of the Vulnerable Software and Affected Versions:
GitLab EE versions 16.6 through 17.1.7
GitLab EE versions 17.2 through 17.2.5
GitLab EE versions 17.3 through 17.3.2
Description:
A privilege escalation issue has been discovered in GitLab EE. This issue allows a user assigned the Admin Group Member custom role to escalate their privileges to include other custom roles.
Recommendations:
For GitLab EE versions 16.6 through 17.1.7, update to version 17.1.7 or later.
For GitLab EE versions 17.2 through 17.2.5, update to version 17.2.5 or later.
For GitLab EE versions 17.3 through 17.3.2, update to version 17.3.2 or later.
As a temporary workaround, consider restricting the use of the Admin Group Member custom role until a patch is available.