CVE-2024-6323

Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/457912	Broken Link
https://gitlab.com/gitlab-org/gitlab/-/issues/457912	Broken Link

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:17.1.0::::enterprise:::

History

21 Nov 2024, 09:49

Type	Values Removed	Values Added
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/457912 - Broken Link~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/457912 - Broken Link

30 Aug 2024, 14:15

Type	Values Removed	Values Added
CWE	~~CWE-653~~

28 Jun 2024, 13:15

Type	Values Removed	Values Added
First Time		Gitlab Gitlab gitlab
CWE		CWE-863
CPE		cpe:2.3:a:gitlab:gitlab:17.1.0::::enterprise::: cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
References	~~() https://gitlab.com/gitlab-org/gitlab/-/issues/457912 -~~	() https://gitlab.com/gitlab-org/gitlab/-/issues/457912 - Broken Link

27 Jun 2024, 12:47

Type	Values Removed	Values Added
Summary		(es) La autorización inadecuada en la búsqueda global en GitLab EE que afecta a todas las versiones desde 16.11 anteriores a 16.11.5 y 17.0 anteriores a 17.0.3 y 17.1 anteriores a 17.1.1 permite que un atacante filtre el contenido de un repositorio privado en un proyecto público.

27 Jun 2024, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-06-27 00:15

Updated : 2024-11-21 09:49

NVD link : CVE-2024-6323

Mitre link : CVE-2024-6323

CVE.ORG link : CVE-2024-6323

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-863

Incorrect Authorization

{"id": "CVE-2024-6323", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2024-06-27T00:15:13.130", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/457912", "tags": ["Broken Link"], "source": "cve@gitlab.com"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/457912", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-863"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project."}, {"lang": "es", "value": " La autorizaci\u00f3n inadecuada en la b\u00fasqueda global en GitLab EE que afecta a todas las versiones desde 16.11 anteriores a 16.11.5 y 17.0 anteriores a 17.0.3 y 17.1 anteriores a 17.1.1 permite que un atacante filtre el contenido de un repositorio privado en un proyecto p\u00fablico."}], "lastModified": "2024-11-21T09:49:25.880", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "5396A016-FF8D-4525-A35A-3E9512C73AE6", "versionEndExcluding": "16.11.5", "versionStartIncluding": "16.11.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "C987EC42-A56B-462A-A0CE-7417CC0FD414", "versionEndExcluding": "17.0.3", "versionStartIncluding": "17.0.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:17.1.0:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "9AA7835D-35E6-44D6-9194-2AC4C38961CE"}], "operator": "OR"}]}], "sourceIdentifier": "cve@gitlab.com"}