CVE-2024-4597CWE-352

Cross-Site Request Forgery (CSRF) in GitLab

Medium · published May 9, 2024

CVSS v3.1
5.7
EPSS
0%
Percentile
23.0
In the wild
Unconfirmed
What it is

An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

The record
Technical detail
CVSS v3.1
5.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00313 · 23.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2024-05-09T01:38Z
EPSS history
Timeline
  • 09 MAY 01:38Z
    Cross-Site Request Forgery (CSRF) in GitLab
    cvelistv5