CVE-2024-2880
Gitlab
CVE-2024-2880 is a vulnerability in GitLab CE/EE that allows a user with the admin_group_member custom role permission to ban group members, affecting versions 16.5 through 17.1.2. This authorization issue could lead to unauthorized actions within GitLab groups. The SVRS score of 34 indicates a moderate risk, suggesting that while the vulnerability isn't critical, it should still be addressed to maintain proper access controls. While the CVSS score is low, understand that the SVRS integrates real-world threat intelligence, providing a more comprehensive risk assessment. Failing to patch this could result in unintended disruption of group member access and potential misuse of administrative privileges. Promptly updating to the patched versions is recommended to mitigate this security risk. It is vital to review and update group member roles to ensure appropriate permissions are in place.
Description:
CVE-2024-2880 is a vulnerability in GitLab CE/EE that allows a user with the admin_group_member custom role permission to ban group members. This vulnerability affects all versions of GitLab CE/EE starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2. The SVRS for this vulnerability is 36, indicating a moderate level of risk.
Key Insights:
- This vulnerability could allow an attacker to ban legitimate users from a group, preventing them from accessing the group's resources.
- The vulnerability is relatively easy to exploit, as it only requires the attacker to have the
admin_group_membercustom role permission. - There are no known active exploits for this vulnerability, but it is possible that exploits could be developed in the future.
Mitigation Strategies:
- Update GitLab CE/EE to the latest version (16.11.6, 17.0.4, or 17.1.2).
- Review the permissions of all users with the
admin_group_membercustom role permission. - Implement additional security measures, such as two-factor authentication, to protect against unauthorized access to GitLab.
Additional Information:
- The Cybersecurity and Infrastructure Security Agency (CISA) has not issued a warning for this vulnerability.
- This vulnerability is not known to be actively exploited in the wild.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.