CVE-2024-8114: Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.
Other sources
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim’s Personal Access Token (PAT) to escalate privileges. This is a high severity issue (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N , 8.2). It is now mitigated in the latest release and is assigned CVE-2024-8114.
— GitLab
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-8114?
CVE-2024-8114 is classified as a privilege escalation vulnerability affecting multiple GitLab versions.
How do I fix CVE-2024-8114?
To fix CVE-2024-8114, upgrade your GitLab instance to version 17.4.5, 17.5.3, or 17.6.1 or later.
Which versions are affected by CVE-2024-8114?
CVE-2024-8114 affects GitLab CE/EE versions from 8.12 to before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1.
Who can exploit CVE-2024-8114?
An attacker with access to a victim's Personal Access Token (PAT) can exploit CVE-2024-8114 to escalate privileges.
What are the consequences of CVE-2024-8114?
Exploitation of CVE-2024-8114 allows unauthorized users to gain elevated privileges within the GitLab platform.