CVE-2024-1525: LDAP user can reset password using secondary email and login using direct authentication
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.2, all versions starting from 16.8 before 16.8.2, all versions starting from 16.9 before 16.9.2. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP. This is a medium severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N, 5.3). It is now mitigated in the latest release and is assigned CVE-2024-1525.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.7.2Fixed in 16.8.2Fixed in 16.9.2 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.7.6 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.8.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.9.1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1525?
CVE-2024-1525 is classified as a medium severity vulnerability affecting GitLab.
How do I fix CVE-2024-1525?
To fix CVE-2024-1525, you should upgrade GitLab to version 16.7.6, 16.8.3, or any version beyond 16.9.1.
Which GitLab versions are affected by CVE-2024-1525?
CVE-2024-1525 affects GitLab versions starting from 16.1 before 16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1.
What type of issue is CVE-2024-1525 related to?
CVE-2024-1525 is related to an LDAP user being able to reset their password under specific conditions.
Is there a workaround for CVE-2024-1525?
Currently, the recommended solution for CVE-2024-1525 is to update to an unaffected version of GitLab, as there is no known workaround.