This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] GitLab CE and EE fix 2 vulnerabilities
GitLab versions 16.9.2, 16.8.4, 16.7.7 fix 2 vulnerabilities in the GitLab Community Edition (CE) and Enterprise Edition (EE) products.
An authenticated remote attacker can bypass permission checks and thereby gain unauthorized access to information [1].
The vulnerability is present in product:
- GitLab; >=11.3.0, <16.7.7; >=16.8.0, <16.8.4; >=16.9.0, <16.9.2;
CVSS: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
More information:
- CVE-2024-0199 at cve.org, NVD
- CWE-284 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2024.
An authenticated remote attacker with "manage_group_access_tokens" permissions can perform privilege escalation [1].
The vulnerability is present in product:
- GitLab; >=16.8.0, <16.8.4; >=16.9.0, <16.9.2;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
More information:
- CVE-2024-1299 at cve.org, NVD
- CWE-863 at cwe.mitre.org
The vulnerability was publicly disclosed 6. 3. 2024.
By CESNET, z.s.p.o. Martin Krajči on 11. 3. 2024.