PT-2024-17852

CVE-2024-1299

Published

2024-03-07

Updated

2024-12-11

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 16.8 prior to 16.8.4 GitLab versions 16.9 prior to 16.9.2

Description A privilege escalation issue was discovered in GitLab. It was possible for a user with a custom role of manage group access tokens to rotate group access tokens with owner privileges.

Recommendations For GitLab versions 16.8 prior to 16.8.4, update to version 16.8.4 or later. For GitLab versions 16.9 prior to 16.9.2, update to version 16.9.2 or later.

Exploitability

Exploit

Fix

Researchers

Ashish

Ashish_R_Padelkar

Vendors

Affected products

Weakness enumeration

CWE-268: Privilege Chaining

Related identifiers

CVE-2024-1299