CVE-2024-4597: Cross-Site Request Forgery (CSRF) in GitLab
First published: Thu May 09 2024(Updated: )
An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.7.0<16.9.7 | |
| GitLab | >=16.7.0<16.9.7 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.11.0<16.11.2 | |
| GitLab | >=16.11.0<16.11.2 |
Remedy
Upgrade to versions 16.9.7, 16.10.5, 16.11.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- agent/remedy
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.7.0
- version/gitlab/16.10.0
- version/gitlab/16.11.0