CVE-2024-3127: Improper Access Control in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.
Other sources
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorized users to perform some actions at the group level. This is a medium severity issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3). It is now mitigated in the latest release and is assigned CVE-2024-3127.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-3127?
CVE-2024-3127 has been classified with a medium severity due to its potential impact on IP restrictions.
How do I fix CVE-2024-3127?
To fix CVE-2024-3127, upgrade GitLab to version 17.1.6 or later, 17.2.4 or later, or 17.3.1 or later.
Which versions of GitLab are affected by CVE-2024-3127?
CVE-2024-3127 affects all versions of GitLab starting from 12.5 up to 17.1.6, as well as specific ranges of 17.2 and 17.3 versions.
What are the potential consequences of CVE-2024-3127?
The potential consequences of CVE-2024-3127 include unauthorized access to resources due to bypassing IP restrictions.
Can CVE-2024-3127 be exploited remotely?
Yes, CVE-2024-3127 can potentially be exploited remotely under certain conditions.