CVE-2024-8754

Summary

CVE-2024-8754 is a vulnerability affecting GitLab EE/CE versions 16.9.7 to 17.1.7, 17.2 to 17.2.5, and 17.3 to 17.3.2, where improper input validation allows attackers to link arbitrary unclaimed provider identities under JWT authentication settings, potentially squatting on accounts. This flaw has a high base severity score of 8.1 and poses significant risks, as it can compromise both confidentiality and integrity, with an exploitability score of 2.8 indicating relatively low complexity for potential attacks requiring minimal privileges and no user interaction. Organizations are advised to upgrade their GitLab instances to the latest versions to remediate this issue effectively. The vulnerability has been categorized under CWE-642, emphasizing its implications on account management security practices within affected systems. Failure to address this vulnerability may expose organizations to unauthorized access and account manipulation risks.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.