Homepage

Cross-site Request Forgery (CSRF) Affecting gitlab package, versions <17.3.5-2

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Cross-site Request Forgery (CSRF) vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-DEBIANUNSTABLE-GITLAB-8681479
  • published1 Feb 2025
  • disclosed31 Jan 2025
Report a new vulnerability Found a mistake?

Introduced: 31 Jan 2025

NewCVE-2024-1211  (opens in a new tab)
CWE-352  (opens in a new tab)

How to fix?

Upgrade Debian:unstable gitlab to version 17.3.5-2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitlab package and not the gitlab package as distributed by Debian. See How to fix? for Debian:unstable relevant fixed versions and status.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.