GitLab Arbitrary Resource Access via Project Creation (CVE-2024-2203)

Vulnerability Summary: GitLab Project Creation Arbitrary Resource Access Vulnerability Vulnerability Overview Vulnerability Name: Users Can Create Projects to Access Arbitrary Resources (CVE-2024-2203) Severity: High (CVSS 8.5/10) Affected Component: GitLab Project Creation Functionality Vulnerability Description: A vulnerability exists that allows users to access resources in different projects by creating projects with the same name. Attackers can exploit this vulnerability to access resources that should be restricted (such as project settings, Webhooks, etc.), even if these resources belong to other projects. Scope of Impact Affected Versions: - ≥ 2.8.0 - ≥ 2.9.0 - ≥ 2.10.0 - ≥ 2.11.0 - ≥ 2.12.0 - ≥ 2.13.0 - ≥ 2.14.0 - ≥ 2.15.0 - ≥ 2.16.0 - ≥ 2.17.0 - ≥ 2.18.0 - ≥ 2.19.0 - ≥ 2.20.0 - ≥ 2.21.0 - ≥ 2.22.0 - ≥ 2.23.0 - ≥ 2.24.0 - ≥ 2.25.0 - ≥ 2.26.0 - ≥ 2.27.0 - ≥ 2.28.0 - ≥ 2.29.0 - ≥ 2.30.0 - ≥ 2.31.0 - ≥ 2.32.0 - ≥ 2.33.0 - ≥ 2.34.0 - ≥ 2.35.0 - ≥ 2.36.0 - ≥ 2.37.0 - ≥ 2.38.0 - ≥ 2.39.0 - ≥ 2.40.0 - ≥ 2.41.0 - ≥ 2.42.0 - ≥ 2.43.0 - ≥ 2.44.0 - ≥ 2.45.0 - ≥ 2.46.0 - ≥ 2.47.0 - ≥ 2.48.0 - ≥ 2.49.0 - ≥ 2.50.0 - ≥ 2.51.0 - ≥ 2.52.0 - ≥ 2.53.0 - ≥ 2.54.0 - ≥ 2.55.0 - ≥ 2.56.0 - ≥ 2.57.0 - ≥ 2.58.0 - ≥ 2.59.0 - ≥ 2.60.0 - ≥ 2.61.0 - ≥ 2.62.0 - ≥ 2.63.0 - ≥ 2.64.0 - ≥ 2.65.0 - ≥ 2.66.0 - ≥ 2.67.0 - ≥ 2.68.0 - ≥ 2.69.0 - ≥ 2.70.0 - ≥ 2.71.0 - ≥ 2.72.0 - ≥ 2.73.0 - ≥ 2.74.0 - ≥ 2.75.0 - ≥ 2.76.0 - ≥ 2.77.0 - ≥ 2.78.0 - ≥ 2.79.0 - ≥ 2.80.0 - ≥ 2.81.0 - ≥ 2.82.0 - ≥ 2.83.0 - ≥ 2.84.0 - ≥ 2.85.0 - ≥ 2.86.0 - ≥ 2.87.0 - ≥ 2.88.0 - ≥ 2.89.0 - ≥ 2.90.0 - ≥ 2.91.0 - ≥ 2.92.0 - ≥ 2.93.0 - ≥ 2.94.0 - ≥ 2.95.0 - ≥ 2.96.0 - ≥ 2.97.0 - ≥ 2.98.0 - ≥ 2.99.0 - ≥ 2.100.0 - ≥ 2.101.0 - ≥ 2.102.0 - ≥ 2.103.0 - ≥ 2.104.0 - ≥ 2.105.0 - ≥ 2.106.0 - ≥ 2.107.0 - ≥ 2.108.0 - ≥ 2.109.0 - ≥ 2.110.0 - ≥ 2.111.0 - ≥ 2.112.0 - ≥ 2.113.0 - ≥ 2.114.0 - ≥ 2.115.0 - ≥ 2.116.0 - ≥ 2.117.0 - ≥ 2.118.0 - ≥ 2.119.0 - ≥ 2.120.0 - ≥ 2.121.0 - ≥ 2.122.0 - ≥ 2.123.0 - ≥ 2.124.0 - ≥ 2.125.0 - ≥ 2.126.0 - ≥ 2.127.0 - ≥ 2.128.0 - ≥ 2.129.0 - ≥ 2.130.0 - ≥ 2.131.0 - ≥ 2.132.0 - ≥ 2.133.0 - ≥ 2.134.0 - ≥ 2.135.0 - ≥ 2.136.0 - ≥ 2.137.0 - ≥ 2.138.0 - ≥ 2.139.0 - ≥ 2.140.0 - ≥ 2.141.0 - ≥ 2.142.0 - ≥ 2.143.0 - ≥ 2.144.0 - ≥ 2.145.0 - ≥ 2.146.0 - ≥ 2.147.0 - ≥ 2.148.0 - ≥ 2.149.0 - ≥ 2.150.0 - ≥ 2.151.0 - ≥ 2.152.0 - ≥ 2.153.0 - ≥ 2.154.0 - ≥ 2.155.0 - ≥ 2.156.0 - ≥ 2.157.0 - ≥ 2.158.0 - ≥ 2.159.0 - ≥ 2.160.0 - ≥ 2.161.0 - ≥ 2.162.0 - ≥ 2.163.0 - ≥ 2.164.0 - ≥ 2.165.0 - ≥ 2.166.0 - ≥ 2.167.0 - ≥ 2.168.0 - ≥ 2.169.0 - ≥ 2.170.0 - ≥ 2.171.0 - ≥ 2.172.0 - ≥ 2.173.0 - ≥ 2.174.0 - ≥ 2.175.0 - ≥ 2.176.0 - ≥ 2.177.0 - ≥ 2.178.0 - ≥ 2.179.0 - ≥ 2.180.0 - ≥ 2.181.0 - ≥ 2.182.0 - ≥ 2.183.0 - ≥ 2.184.0 - ≥ 2.185.0 - ≥ 2.186.0 - ≥ 2.187.0 - ≥ 2.188.0 - ≥ 2.189.0 - ≥ 2.190.0 - ≥ 2.191.0 - ≥ 2.192.0 - ≥ 2.193.0 - ≥ 2.194.0 - ≥ 2.195.0 - ≥ 2.196.0 - ≥ 2.197.0 - ≥ 2.198.0 - ≥ 2.199.0 - ≥ 2.200.0 - ≥ 2.201.0 - ≥ 2.202.0 - ≥ 2.203.0 - ≥ 2.204.0 - ≥ 2.205.0 - ≥ 2.206.0 - ≥ 2.207.0 - ≥ 2.208.0 - ≥ 2.209.0 - ≥ 2.210.0 - ≥ 2.211.0 - ≥ 2.212.0 - ≥ 2.213.0 - ≥ 2.214.0 - ≥ 2.215.0 - ≥ 2.216.0 - ≥ 2.217.0 - ≥ 2.218.0 - ≥ 2.219.0 - ≥ 2.220.0 - ≥ 2.221.0 - ≥ 2.222.0 - ≥ 2.223.0 - ≥ 2.224.0 - ≥ 2.225.0 - ≥ 2.226.0 - ≥ 2.227.0 - ≥ 2.228.0 - ≥ 2.229.0 - ≥ 2.230.0 - ≥ 2.231.0 - ≥ 2.232.0 - ≥ 2.233.0 - ≥ 2.234.0 - ≥ 2.235.0 - ≥ 2.236.0 - ≥ 2.237.0 - ≥ 2.238.0 - ≥ 2.239.0 - ≥ 2.240.0 - ≥ 2.241.0 - ≥ 2.242.0 - ≥ 2.243.0 - ≥ 2.244.0 - ≥ 2.245.0 - ≥ 2.246.0 - ≥ 2.247.0 - ≥ 2.248.0 - ≥ 2.249.0 - ≥ 2.250.0 - ≥ 2.251.0 - ≥ 2.252.0 - ≥ 2.253.0 - ≥ 2.254.0 - ≥ 2.255.0 - ≥ 2.256.0 - ≥ 2.257.0 - ≥ 2.258.0 - ≥ 2.259.0 - ≥ 2.260.0 - ≥ 2.261.0 - ≥ 2.262.0 - ≥ 2.263.0 - ≥ 2.264.0 - ≥ 2.265.0 - ≥ 2.266.0 - ≥ 2.267.0 - ≥ 2.268.0 - ≥ 2.269.0 - ≥ 2.270.0 - ≥ 2.271.0 - ≥ 2.272.0 - ≥ 2.273.0 - ≥ 2.274.0 - ≥ 2.275.0 - ≥ 2.276.0 - ≥ 2.277.0 - ≥ 2.278.0 - ≥ 2.279.0 - ≥ 2.280.0 - ≥ 2.281.0 - ≥ 2.282.0 - ≥ 2.283.0 - ≥ 2.284.0 - ≥ 2.285.0 - ≥ 2.286.0 - ≥ 2.287.0 - ≥ 2.288.0 - ≥ 2.289.0 - ≥ 2.290.0 - ≥ 2.291.0 - ≥ 2.292.0 - ≥ 2.293.0 - ≥ 2.294.0 - ≥ 2.295.0 - ≥ 2.296.0 - ≥ 2.297.0 - ≥ 2.298.0 - ≥ 2.299.0 - ≥ 2.300.0 - ≥ 2.301.0 - ≥ 2.302.0 - ≥ 2.303.0 - ≥ 2.304.0 - ≥ 2.305.0 - ≥ 2.306.0 - ≥ 2.307.0 - ≥ 2.308.0 - ≥ 2.309.0 - ≥ 2.310.0 - ≥ 2.311.0 - ≥ 2.312.0 - ≥ 2.313.0 - ≥ 2.314.0 - ≥ 2.315.0 - ≥ 2.316.0 - ≥ 2.317.0 - ≥ 2.318.0 - ≥ 2.319.0 - ≥ 2.320.0 - ≥ 2.321.0 - ≥ 2.322.0 - ≥ 2.323.0 - ≥ 2.324.0 - ≥ 2.325.0 - ≥ 2.326.0 - ≥ 2.327.0 - ≥ 2.328.0 - ≥ 2.329.0 - ≥ 2.330.0 - ≥ 2.331.0 - ≥ 2.332.0 - ≥ 2.333.0 - ≥ 2.334.0 - ≥ 2.335.0 - ≥ 2.336.0 - ≥ 2.337.0 - ≥ 2.338.0 - ≥ 2.339.0 - ≥ 2.340.0 - ≥ 2.341.0 - ≥ 2.342.0 - ≥ 2.343.0 - ≥ 2.344.0

Goal Reached Thanks to every supporter — we hit 100%!

GitLab Arbitrary Resource Access via Project Creation (CVE-2024-2203)

More from this source