Improper certificate validation in GitLab Enterprise Edition and Gitlab Community Edition - #VU50844
Published: February 22, 2021
Vulnerability identifier: #VU50844
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to improper validation of the certificates for the Fortinet OTP. A remote attacker can bypass 2FA process and gain unauthorized access to the application.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
Remediation
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 13.7.7, 13.8.4
Gitlab Community Edition - addressed in versions 13.7.7, 13.8.4
Gitlab Community Edition - addressed in versions 13.7.7, 13.8.4