Input validation error in GitLab Enterprise Edition and Gitlab Community Edition - #VU97222
Published: September 12, 2024
Vulnerability identifier: #VU97222
CSH Severity: Medium
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to insufficient validation of user-supplied input. A remote user can squat on accounts via linking arbitrary unclaimed provider identities when JWT authentication is configured.
Affected software
GitLab Enterprise Edition
Gitlab Community Edition
Gitlab Community Edition
Remediation
Install updates from vendor's website.
GitLab Enterprise Edition - addressed in versions 17.1.7, 17.2.5, 17.3.2
Gitlab Community Edition - addressed in versions 17.1.7, 17.2.5, 17.3.2
Gitlab Community Edition - addressed in versions 17.1.7, 17.2.5, 17.3.2