VulnerabilityAnalyzed

CVE-2024-4597

An attacker could force a user with an active SAML session to approve an MR via CSRF.

MEDIUM 6.5EPSS 0.28%

Does this matter?

Lower severity and a low EPSS score (0.28%). Track it; it rarely justifies an emergency change on its own.

Description

An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS: 0.28% probability · 21th percentile
CISA KEV: Not listed
Weakness: CWE-352
Affected: gitlab/gitlab
Source: cve@gitlab.com

References

https://gitlab.com/gitlab-org/gitlab/-/issues/438686Broken Link
https://gitlab.com/gitlab-org/gitlab/-/issues/438686Broken Link

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.