CVE-2024-4024

high · 7.3

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.

7.3

CVSS

14.9%

EPSS (exploit prob.)

97th

EPSS percentile

2024-04-25

Published

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-302CWE-287

Affected products

Vendor	Product	Affected versions
gitlab	gitlab	>= 7.8.0, < 16.9.6
gitlab	gitlab	>= 7.8.0, < 16.9.6
gitlab	gitlab	>= 16.10.0, < 16.10.4
gitlab	gitlab	>= 16.10.0, < 16.10.4
gitlab	gitlab	16.11.0
gitlab	gitlab	16.11.0

Check a specific version with /api/v1/cve/match.

References

https://gitlab.com/gitlab-org/gitlab/-/issues/452426
https://gitlab.com/gitlab-org/gitlab/-/issues/452426

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-4024