CVE-2024-1211 — Cross-Site Request Forgery (CSRF) in GitLab

CVE-2024-1211

Cross-Site Request Forgery (CSRF) in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 10.6 before 16.9.7; affected 16.10 before 16.10.5; affected 16.11 before 16.11.2

CWE

CWE-352

References

https://gitlab.com/gitlab-org/gitlab/-/issues/440313
https://hackerone.com/reports/2323594

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.