Description
An issue was discovered in GitLab CE/EE affecting all versions starting from 17.2 prior to 17.3.7, starting from 17.4 prior to 17.4.4 and starting from 17.5 prior to 17.5.2, which could have allowed an attacker gaining full API access as the victim via the Device OAuth flow.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| GitLab | GitLab | 17.2 – < 17.3.7, 17.4 – < 17.4.4, 17.5 – < 17.5.2 | 17.3.7 |
Advisories 2
- WID-SEC-2024-3453 GitLab: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 6, 2025
- NCSC-2024-0447 Kwetsbaarheden verholpen in GitLab CE/EE NCSC-NL (Netherlands) · Nov 15, 2024
References
- GitLab Issue #476670 issue-tracking permissions-required
- HackerOne Bug Bounty Report #2627925 technical-description exploit permissions-required
- https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#device-oauth-flow-allows-for-cross-window-forgery