CVE-2024-0410CWE-841

Improper Enforcement of Behavioral Workflow in GitLab

High · published February 21, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

An authorization bypass vulnerability was discovered in GitLab affecting versions 15.1 prior to 16.7.6, 16.8 prior to 16.8.3, and 16.9 prior to 16.9.1. A developer could bypass CODEOWNERS approvals by creating a merge conflict.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00458 · 38.8th percentile
Weakness
CWE-841 · Improper Enforcement of Behavioral Workflow
Published
2024-02-21T23:30Z
EPSS history
Timeline
  • 21 FEB 23:30Z
    Improper Enforcement of Behavioral Workflow in GitLab
    cvelistv5