CVE-2024-0861: Direct Request ('Forced Browsing') in GitLab
First published: Wed Feb 21 2024(Updated: )
An issue has been discovered in GitLab EE affecting all versions starting from 16.4 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Users with the `Guest` role can change `Custom dashboard projects` settings contrary to permissions.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.4.0<16.7.6 | |
| GitLab | >=16.8.0<16.8.3 | |
| GitLab | =16.9.0 |
Remedy
Upgrade to versions 16.9.1, 16.8.3, 16.7.6 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-0861?
CVE-2024-0861 is considered a medium severity vulnerability due to the potential for unauthorized changes by users with the Guest role.
How do I fix CVE-2024-0861?
To fix CVE-2024-0861, upgrade GitLab to version 16.7.6 or 16.8.3 and later, or to any version above 16.9.1.
Who is affected by CVE-2024-0861?
CVE-2024-0861 affects all GitLab EE versions from 16.4 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1.
What types of settings can be changed due to CVE-2024-0861?
Due to CVE-2024-0861, users with the Guest role can change Custom dashboard project settings contrary to permissions.
What version of GitLab should I update to in response to CVE-2024-0861?
You should update to GitLab version 16.7.6, 16.8.3, or any version higher than 16.9.1 to mitigate CVE-2024-0861.
- agent/remedy
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.4.0
- version/gitlab/16.8.0
- version/gitlab/16.9.0