CVE-2024-1525

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.1 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. Under some specialized conditions, an LDAP user may be able to reset their password using their verified secondary email address and sign-in using direct authentication with the reset password, bypassing LDAP.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-288

Affected software

VendorProductVersions
GitLabGitLab>= 16.1, < 16.7.6; >= 16.8, < 16.8.3; >= 16.9, < 16.9.1

References

Timeline

Published
Feb 22, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-15265.3The Hubbub Lite WordPress plugin before 1.33.1 does not ensure that user have access to password protected post before displaying its conteCVE-2024-15278.8Unrestricted file upload vulnerability in CMS Made Simple, affecting version 2.2.14. This vulnerability allows an authenticated user to bypaCVE-2024-15286.1CMS Made Simple version 2.2.14, does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS) vulnerability CVE-2024-15296.1Vulnerability in CMS Made Simple 2.2.14, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting (XSS)CVE-2024-15308.8A vulnerability, which was classified as critical, has been found in ECshop 4.1.8. Affected by this issue is some unknown functionality of tCVE-2024-15318.2A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor couCVE-2024-15326.8A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor couCVE-2024-15335.4The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the HTML Element in CVE-2024-15345.4The Booster for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions CVE-2024-15355.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPreCVE-2024-15367.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to StCVE-2024-15376.4The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to St
CVE-2024-1525: Medium severity, CVSS 5.3 | Vulnix