HIGH
CVE-2024-6323
CVSS
7.5
Description
Improper authorization in global search in GitLab EE affecting all versions from 16.11 prior to 16.11.5 and 17.0 prior to 17.0.3 and 17.1 prior to 17.1.1 allows an attacker leak content of a private repository in a public project.
Summary dbcve.org
Improper authorization in GitLab EE's global search feature allows authenticated attackers to bypass access controls and leak content from private repositories embedded within public projects. This authorization bypass occurs because the global search does not properly enforce repository-level access controls when searching across projects.
Mitigation
Upgrade GitLab EE to version 16.11.5, 17.0.3, 17.1.1 or later to resolve the authorization flaw in global search.
Weakness (CWE)
CWE-863
Incorrect Authorization
EPSS Score
0.52%
Probability of exploitation in next 30 days
43.2th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.