CVE-2024-4660
Description
An issue has been discovered in GitLab EE affecting all versions starting from 11.2 before 17.1.7, all versions starting from 17.2 before 17.2.5, all versions starting from 17.3 before 17.3.2. It was possible for a guest to read the source code of a private project by using group templates.
Summary dbcve.org
A broken access control vulnerability in GitLab EE allows guest users to bypass intended restrictions and read source code of private projects by leveraging group templates. The guest user exploits the template feature to access code they should not be authorized to view.
Mitigation
Upgrade GitLab to versions 17.1.7+, 17.2.5+, or 17.3.2+ to patch the access control flaw. Alternatively, restrict or disable guest user access to private projects until the upgrade can be applied.