CVE-2024-1211: Require confirmation before linking JWT identity
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-1211?
CVE-2024-1211 is considered a high-severity vulnerability due to its potential for cross-site request forgery.
How do I fix CVE-2024-1211?
To fix CVE-2024-1211, update GitLab CE/EE to version 16.9.7 or later, 16.10.5 or later, or 16.11.2 or later.
What versions of GitLab are affected by CVE-2024-1211?
CVE-2024-1211 affects GitLab CE/EE versions starting from 10.6 up to but not including 16.9.7, 16.10 prior to 16.10.5, and 16.11 prior to 16.11.2.
Can CVE-2024-1211 be exploited remotely?
Yes, CVE-2024-1211 can potentially be exploited remotely if the affected GitLab instances are configured to use JWT as an OmniAuth provider.
What is the nature of the vulnerability in CVE-2024-1211?
CVE-2024-1211 is a cross-site request forgery vulnerability that may allow attackers to perform unauthorized actions on behalf of a user.