CVE-2024-8754
External Control of Critical State Data in GitLab
8.1
HIGH
CVSS 3.1
EPSS 0.03%
Description
An issue has been discovered in GitLab EE/CE affecting all versions from 16.9.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2. An improper input validation error allows attacker to squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.
How to fix CVE-2024-8754
To remediate CVE-2024-8754, upgrade the affected package to a fixed version below.
- —upgrade to 17.1.7 or later
Is CVE-2024-8754 being exploited?
Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.
Affected packages (1)
- >= 16.9.7, < 17.1.7, >= 17.2.0, < 17.2.5, >= 17.3.0, < 17.3.2
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |