An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before     17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access     Token (PAT) to escalate privileges. (CVE-2024-8114)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 2263ea04-ac81-11ef-998c-2cf05da270f3 advisory.

    Gitlab reports:
    Privilege Escalation via LFS Tokens     DoS through uncontrolled resource consumption when viewing a maliciously crafted cargo.toml file     Unintended Access to Usage Data via Scoped Tokens     Gitlab DOS via Harbor registry integration     Resource exhaustion and denial of service with test_report API calls     Streaming endpoint did not invalidate tokens after revocation

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of GitLab installed on the remote host is affected by a vulnerability, as follows:

  - Missing Authorization in GitLab (CVE-2024-8114)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258737	Linux Distros Unpatched Vulnerability : CVE-2024-8114	Nessus	Misc.	high
211918	FreeBSD : Gitlab -- vulnerabilities (2263ea04-ac81-11ef-998c-2cf05da270f3)	Nessus	FreeBSD Local Security Checks	high
211857	GitLab 8.12 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-8114)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-8114

high

Tenable Plugins

high

high

high