CVE-2024-4024
An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.8 before 16.9.6, all versions starting from 16.10 before 16.10.4, all versions starting from 16.11 before 16.11.1. Under certain conditions, an attacker with their Bitbucket account credentials may be able to take over a GitLab account linked to another user's Bitbucket account, if Bitbucket is used as an OAuth 2.0 provider on GitLab.
- Affected products
- Bitbucket, Gitlab, Gitlab Ce/Ee
- Gitlab
- < 16.9.6, 16.10.4, 16.11.0
- Fix
- Available
- CVSS 3.1
- 8.8 HIGH
- EPSS
- 14.9% (96th percentile)
- Weakness
- CWE-287, CWE-302
- NVD status
- Analyzed
- Published
- 2024-04-25
Fix
Upgrade to versions 16.9.6, 16.10.4 or 16.11.1 or above
CVE-2024-4024 at NVD
No indexed exploits for CVE-2024-4024 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2024-4024 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.