GitLab EE Vulnerability: CSRF Attack on SAML Sessions

CVE-2024-4597

5.7MEDIUM

Key Information

Vendor: Gitlab
Status: Gitlab
Vendor: CVE Published:; 14 May 2024

Summary

An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

Affected Version(s)

GitLab < 16.9.7

GitLab < 16.10.5

GitLab < 16.11.2

CVSS V3.1

Score:

5.7

Severity:

MEDIUM

Confidentiality:

None

Integrity:

High

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

Required

Scope:

Unchanged

Timeline

Vulnerability published.
May 14, 2024
Vulnerability Reserved.
May 7, 2024

Collectors

NVD DatabaseMitre Database

Credit

This vulnerability was reported internally by a GitLab team member [joernchen](https://gitlab.com/joernchen)