CVE-2024-13041

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups.

CVSS v3 4.2 MEDIUM

4.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configuration	Release Notes Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/479165	Exploit Issue Tracking

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*
	cpe:2.3:a:gitlab:gitlab:::::community:::*
	cpe:2.3:a:gitlab:gitlab:::::enterprise:::*

History

No history.

Information

Published : 2025-01-09 07:15

Updated : 2025-08-05 15:12

NVD link : CVE-2024-13041

Mitre link : CVE-2024-13041

CVE.ORG link : CVE-2024-13041

JSON object : View

Products Affected

gitlab

gitlab

CWE

CWE-286

Incorrect User Management

{"id": "CVE-2024-13041", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.2, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "published": "2025-01-09T07:15:26.497", "references": [{"url": "https://about.gitlab.com/releases/2025/01/08/patch-release-gitlab-17-7-1-released/#instance-saml-does-not-respect-external_provider-configuration", "tags": ["Release Notes", "Vendor Advisory"], "source": "[email protected]"}, {"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/479165", "tags": ["Exploit", "Issue Tracking"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-286"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in GitLab CE/EE affecting all versions starting from 16.4 prior to 17.5.5, starting from 17.6 prior to 17.6.3, and starting from 17.7 prior to 17.7.1. When a user is created via the SAML provider, the external groups setting overrides the external provider configuration. As a result, the user may not be marked as external thereby giving those users access to internal projects or groups."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde la 16.4 hasta la 17.5.5, desde la 17.6 hasta la 17.6.3 y desde la 17.7 hasta la 17.7.1. Cuando se crea un usuario a trav\u00e9s del proveedor SAML, la configuraci\u00f3n de grupos externos anula la configuraci\u00f3n del proveedor externo. Como resultado, es posible que el usuario no se marque como externo, lo que le otorga acceso a proyectos o grupos internos."}], "lastModified": "2025-08-05T15:12:48.187", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "913E9C5D-ECFD-4366-A861-B4405CDC160D", "versionEndExcluding": "17.5.5", "versionStartIncluding": "16.4.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2F761D8C-2AA9-4204-B6D5-41164ABD54C4", "versionEndExcluding": "17.5.5", "versionStartIncluding": "16.4.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "8BFB4F2D-7692-4241-AF8B-A0C5B5FA6021", "versionEndExcluding": "17.6.3", "versionStartIncluding": "17.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "464F7155-C7C2-4881-A78F-FB949540F3A9", "versionEndExcluding": "17.6.3", "versionStartIncluding": "17.6.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "621F0CA2-6B85-45B3-92E0-5DE6D9724592", "versionEndExcluding": "17.7.1", "versionStartIncluding": "17.7.0"}, {"criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "1C6BA293-BDF4-4D50-BD54-0329E00FC5ED", "versionEndExcluding": "17.7.1", "versionStartIncluding": "17.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}