CVE-2024-3127 — Improper Access Control in GitLab

CVE-2024-3127

Improper Access Control in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 12.5 before 17.1.6; affected 17.2 before 17.2.4; affected 17.3 before 17.3.1

CWE

CWE-284

References

https://gitlab.com/gitlab-org/gitlab/-/issues/452640
https://hackerone.com/reports/2395169

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.