CVE-2024-3127: Improper Access Control in GitLab
First published: Thu Aug 22 2024(Updated: )
An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=12.5.0<17.1.6 | |
| GitLab | >=12.5.0<17.1.6 | |
| GitLab | >=17.2.0<17.2.4 | |
| GitLab | >=17.2.0<17.2.4 | |
| GitLab | =17.3.0 | |
| GitLab | =17.3.0 |
Remedy
Upgrade to versions 17.1.6, 17.2.4, 17.3.1 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-3127?
CVE-2024-3127 has been classified with a medium severity due to its potential impact on IP restrictions.
How do I fix CVE-2024-3127?
To fix CVE-2024-3127, upgrade GitLab to version 17.1.6 or later, 17.2.4 or later, or 17.3.1 or later.
Which versions of GitLab are affected by CVE-2024-3127?
CVE-2024-3127 affects all versions of GitLab starting from 12.5 up to 17.1.6, as well as specific ranges of 17.2 and 17.3 versions.
What are the potential consequences of CVE-2024-3127?
The potential consequences of CVE-2024-3127 include unauthorized access to resources due to bypassing IP restrictions.
Can CVE-2024-3127 be exploited remotely?
Yes, CVE-2024-3127 can potentially be exploited remotely under certain conditions.
- agent/title
- agent/references
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/12.5.0
- version/gitlab/17.2.0
- version/gitlab/17.3.0