CVE-2024-2177: Improper Restriction of Rendered UI Layers or Frames in GitLab
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-2177?
CVE-2024-2177 has been classified with a high severity level due to its potential impact on OAuth authentication.
How do I fix CVE-2024-2177?
To mitigate CVE-2024-2177, update GitLab CE/EE to versions 16.11.5, 17.0.3, or 17.1.1 or later.
What versions of GitLab are affected by CVE-2024-2177?
CVE-2024-2177 affects GitLab CE/EE versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1.
What type of vulnerability is CVE-2024-2177?
CVE-2024-2177 is a Cross Window Forgery vulnerability that exploits the OAuth authentication flow.
Can I be attacked through CVE-2024-2177 if I am using an updated version of GitLab?
No, if you are using an updated version of GitLab that is not affected, you are not vulnerable to CVE-2024-2177.