CVE-2024-4597: Cross-Site Request Forgery (CSRF) in GitLab
An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 16.9.7Fixed in 16.10.5Fixed in 16.11.2 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.9.7 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.10.5 - Upgrade
Upgrade
GitLab EEto a version that resolves this vulnerability.Fixed in 16.11.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2024-4597
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-4597?
CVE-2024-4597 is considered a medium severity vulnerability due to the potential for CSRF exploitation leading to unauthorized actions.
How do I fix CVE-2024-4597?
To fix CVE-2024-4597, upgrade your GitLab instance to version 16.9.7, 16.10.5, or 16.11.2 or later.
What impact does CVE-2024-4597 have on GitLab users?
CVE-2024-4597 allows attackers to exploit an active SAML session to force users to approve merge requests through CSRF.
Which versions of GitLab are affected by CVE-2024-4597?
CVE-2024-4597 affects GitLab EE versions from 16.7 before 16.9.7, 16.10 from 16.10.0 before 16.10.5, and 16.11 from 16.11.0 before 16.11.2.
Is there a way to mitigate the risk of CVE-2024-4597 before upgrading?
While upgrading is the best solution, you can mitigate CVE-2024-4597 risk by monitoring and controlling user sessions and implementing CSRF protection in your applications.