CVE-2024-8631
Gitlab 16.6.0 – 17.1.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:NSummary
CVE-2024-8631 is a medium-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Gitlab Gitlab. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 41th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49310
Vulnerability Data
A privilege escalation issue has been discovered in GitLab EE affecting all versions starting from 16.6 prior to 17.1.7, from 17.2 prior to 17.2.5, and from 17.3 prior to 17.3.2. A user assigned the Admin Group Member custom role could…
more
have escalated their privileges to include other custom roles.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 10 hardening rules · 4 OS baselines
V13.2.2V3.7.3V9.2.2V9.2.3
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing least-privilege permissions directly reduces the chance that a privilege permits unintended unsafe actions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
Access control policy can limit unsafe privilege use but does not define safe actions for each privilege.
Access rights assignment can restrict privileges to intended actions, yet does not guarantee the privilege itself is safe.
Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
Privileged access rights control can restrict unsafe privileges, yet does not ensure the privilege definition itself is safe.
Secure development lifecycle can catch unsafe privilege definitions during design but does not prevent them at runtime.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. via CWE-267
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-267