CVE-2024-0456CWE-425

Direct Request ('Forced Browsing') in GitLab

Medium · published January 26, 2024

CVSS v3.1
4.3
EPSS
0%
Percentile
41.1
In the wild
Unconfirmed
What it is

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00488 · 41.1th percentile
Weakness
CWE-425 · Direct Request ('Forced Browsing')
Published
2024-01-26T01:02Z
EPSS history
Timeline
  • 26 JAN 01:02Z
    Direct Request ('Forced Browsing') in GitLab
    cvelistv5