CVE-2024-8754
CVSS 3.1 Score 8.1 of 10 (high)
Details
Summary
CVE-2024-8754 is a vulnerability affecting GitLab EE/CE versions 16.9.7 to 17.1.7, 17.2 to 17.2.5, and 17.3 to 17.3.2, where improper input validation allows attackers to link arbitrary unclaimed provider identities under JWT authentication settings, potentially squatting on accounts. This flaw has a high base severity score of 8.1 and poses significant risks, as it can compromise both confidentiality and integrity, with an exploitability score of 2.8 indicating relatively low complexity for potential attacks requiring minimal privileges and no user interaction. Organizations are advised to upgrade their GitLab instances to the latest versions to remediate this issue effectively. The vulnerability has been categorized under CWE-642, emphasizing its implications on account management security practices within affected systems. Failure to address this vulnerability may expose organizations to unauthorized access and account manipulation risks.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions