CVE-2024-0199

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-0199
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0199.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-0199
Aliases
Downstream
Published
2024-03-07T00:39:50.159Z
Modified
2026-04-10T05:07:51.512454Z
Severity
  • 7.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
Incorrect Authorization in GitLab
Details

An authorization bypass vulnerability was discovered in GitLab affecting versions 11.3 prior to 16.7.7, 16.7.6 prior to 16.8.4, and 16.8.3 prior to 16.9.2. An attacker could bypass CODEOWNERS by utilizing a crafted payload in an old feature branch to perform malicious actions.

Database specific 
{
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0199.json"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1bbe39452664021af90851aef8527ce5e850343e
Fixed
8d2bc7e01afa79a3bd9c40298c6d41a9c68be2a0
Database specific 
{
    "versions": [
        {
            "introduced": "11.3"
        },
        {
            "fixed": "16.7.7"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
1e912d57d5a8f1135f4d41e25469069790134d41
Fixed
5e8469c3a8c7fae68639fe31ea6ddda6b1f2b8d0
Database specific 
{
    "versions": [
        {
            "introduced": "16.8"
        },
        {
            "fixed": "16.8.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
76326ae8b898b38c8217ad037ed7122be00e62f0
Fixed
0d71d32d32191ce53dc39ff2ef1f55340848997c
Database specific 
{
    "versions": [
        {
            "introduced": "16.9"
        },
        {
            "fixed": "16.9.2"
        }
    ]
}

Affected versions

v16.*
v16.8.0-ee
v16.9.0-ee
v16.9.0-rc44-ee

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-0199.json"