CVE-2024-1299

HIGH Year: 2024
CVSS v3 Score
8.1
High
Weakness Type
CWE-268
View all →

Vulnerability Description

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of `manage_group_access_tokens` to rotate group access tokens with owner privileges.

Related Vulnerabilities

CVE-2024-47045

HIGH
CVSS:7.8(High)

Privilege chaining issue exists in the installer of e-Tax software(common program). If this vulnerability is exploited, a malicious DLL prepared by an attacker may be executed with higher privileges t...

CWE-2682024

CVE-2023-0971

HIGH
CVSS:8.8(High)

A logic error in SiLabs Z/IP Gateway SDK 7.18.02 and earlier allows authentication to be bypassed, remote administration of Z-Wave controllers, and S0/S2 encryption keys to be recovered.

CWE-2682023

CVE-2023-5839

HIGH
CVSS:8.8(High)

Privilege Chaining in GitHub repository hestiacp/hestiacp prior to 1.8.9.

CWE-2682023

CVE-2024-4877

HIGH
CVSS:8.8(High)

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privil...

CWE-2682024

CVE-2023-2250

MEDIUM
CVSS:6.7(Medium)

A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registration-controller or cluster-manager deployments. A malicious user...

CWE-2682023

CVE-2024-1250

MEDIUM
CVSS:6.5(Medium)

An issue has been discovered in GitLab EE affecting all versions starting from 16.8 before 16.8.2. When a user is assigned a custom role with manage_group_access_tokens permission, they may be able to...

CWE-2682024