CVE-2024-5258

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An authorization vulnerability exists within GitLab from versions 16.10 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1 where an authenticated attacker could utilize a crafted naming convention to bypass pipeline authorization logic.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639CWE-863

Affected software

No affected versions have been published.

Timeline

Published
May 23, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-525817.5Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.13.0, the multipart form parser shipped with litesCVE-2024-525824.7Cachi2 is a command-line interface tool that pre-fetches a project's dependencies to aid in making the project's build process network-isolaCVE-2024-525838.2The WesHacks GitHub repository provides the official Hackathon competition website source code for the Muweilah Wesgreen Hackathon. The pageCVE-2024-525845.4Autolab is a course management service that enables auto-graded programming assignments. There is a vulnerability in version 3.0.1 where CAsCVE-2024-525855.4Autolab is a course management service that enables auto-graded programming assignments. There is an HTML injection vulnerability in versionCVE-2024-525867.8eLabFTW is an open source electronic lab notebook for research labs. A vulnerability has been found starting in version 4.6.0 and prior to vCVE-2024-525878.8StepSecurity's Harden-Runner provides network egress filtering and runtime security for GitHub-hosted and self-hosted runners. Versions of sCVE-2024-525887.5Strapi is an open-source content management system. Prior to version 4.25.2, inputting a local domain into the Webhooks URL field leads to tCVE-2024-525892.7Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and throuCVE-2024-52595.4The MultiVendorX Marketplace – WooCommerce MultiVendor Marketplace Solution plugin for WordPress is vulnerable to Stored Cross-Site ScriptinCVE-2024-525906.5Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` allows aCVE-2024-525919.3Misskey is an open source, federated social media platform. In affected versions missing validation in `ApRequestService.signedGet` and `Htt
CVE-2024-5258: Medium severity, CVSS 4.3 | Vulnix