What is CVE-2024-0456?

CVE-2024-0456 is a medium-severity vulnerability in Gitlab, classified under Direct Request (Forced Browsing). CVSS score: 4.3/10. Published 2024-01-26.

How severe is CVE-2024-0456?

Medium severity. CVSS v3 base score is 4.3 out of 10.

Is CVE-2024-0456 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Gitlab

CVE-2024-0456

An authorization vulnerability exists in GitLab versions 14.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. An unauthorized attacker is able to assign arbitrary users to MRs that they created within the project

EPSS: 0.005 (39.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

Affected products

Gitlab — versions 14.0, 16.8.0, 16.8

Weakness classification (CWE)

CWE-425 — Direct Request (Forced Browsing)

Public proof-of-concept exploits

References

cve@gitlab.com (Vendor Advisory)
cve@gitlab.com (issue-tracking, permissions-required, Broken Link)

Frequently asked questions

What is CVE-2024-0456?: CVE-2024-0456 is a medium-severity vulnerability in Gitlab, classified under Direct Request (Forced Browsing). CVSS score: 4.3/10. Published 2024-01-26.
How severe is CVE-2024-0456?: Medium severity. CVSS v3 base score is 4.3 out of 10.
Is CVE-2024-0456 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.