CVE-2024-4597: Cross-Site Request Forgery (CSRF) in GitLab
First published: Thu May 09 2024(Updated: )
An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.7.0<16.9.7 | |
| GitLab | >=16.7.0<16.9.7 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.10.0<16.10.5 | |
| GitLab | >=16.11.0<16.11.2 | |
| GitLab | >=16.11.0<16.11.2 |
Remedy
Upgrade to versions 16.9.7, 16.10.5, 16.11.2 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-4597?
CVE-2024-4597 is considered a medium severity vulnerability due to the potential for CSRF exploitation leading to unauthorized actions.
How do I fix CVE-2024-4597?
To fix CVE-2024-4597, upgrade your GitLab instance to version 16.9.7, 16.10.5, or 16.11.2 or later.
What impact does CVE-2024-4597 have on GitLab users?
CVE-2024-4597 allows attackers to exploit an active SAML session to force users to approve merge requests through CSRF.
Which versions of GitLab are affected by CVE-2024-4597?
CVE-2024-4597 affects GitLab EE versions from 16.7 before 16.9.7, 16.10 from 16.10.0 before 16.10.5, and 16.11 from 16.11.0 before 16.11.2.
Is there a way to mitigate the risk of CVE-2024-4597 before upgrading?
While upgrading is the best solution, you can mitigate CVE-2024-4597 risk by monitoring and controlling user sessions and implementing CSRF protection in your applications.
- agent/remedy
- agent/references
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.7.0
- version/gitlab/16.10.0
- version/gitlab/16.11.0