CVE-2024-12093 — Improper Validation of Consistency within Input in GitLab

CVE-2024-12093

Improper Validation of Consistency within Input in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 11.1 before 17.10.7; affected 17.11 before 17.11.3; affected 18.0 before 18.0.1

CWE

CWE-1288

References

https://gitlab.com/gitlab-org/gitlab/-/issues/507445
https://hackerone.com/reports/2851261

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.