BIT-gitlab-2024-1299

See a problem?
Import Source
https://github.com/bitnami/vulndb/tree/main/data/gitlab/BIT-gitlab-2024-1299.json
JSON Data
https://api.osv.dev/v1/vulns/BIT-gitlab-2024-1299
Aliases
Published
2024-03-12T08:24:19.293Z
Modified
2025-05-20T10:02:07.006Z
Summary
Privilege Chaining in GitLab
Details

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of manage_group_access_tokens to rotate group access tokens with owner privileges.

Database specific 
{
    "cpes": [
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:community:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:enterprise:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*"
    ],
    "severity": "High"
}
References

Affected packages

Bitnami / gitlab

Package

Name
gitlab
Purl
pkg:bitnami/gitlab

Severity

  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Affected ranges

Type
SEMVER
Events
Introduced
16.8.0
Fixed
16.8.4
Introduced
16.9.0
Fixed
16.9.2