PT-2023-17378 · Gitlab · Gitlab Ce/Ee+1

Bull · Publicado 2023-05-03 · Atualizado 2024-03-06 · CVE-2023-1965

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Média

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 14.2 through 15.9.5 GitLab EE versions 15.10 through 15.10.4 GitLab EE versions 15.11 through 15.11.0

Description An issue has been discovered in GitLab EE, where a lack of verification on the RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature is not enabled by default.

Recommendations For GitLab EE versions 14.2 through 15.9.5, update to version 15.9.6 or later. For GitLab EE versions 15.10 through 15.10.4, update to version 15.10.5 or later. For GitLab EE versions 15.11 through 15.11.0, update to version 15.11.1 or later. As a temporary workaround, consider restricting access to the RelayState parameter to minimize the risk of exploitation.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

BIT-GITLAB-2023-1965

CVE-2023-1965

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1965.json · Exploit
• https://t.me/cvenotify/50083 · Publicação no Telegram
• https://osv.dev/vulnerability/BIT-gitlab-2023-1965 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1965.json · Nota
• https://gitlab.com/gitlab-org/gitlab/-/issues/406235 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1965 · Nota
• https://osv.dev/vulnerability/CVE-2023-1965 · Aviso do Fabricante
• https://t.me/cibsecurity/63249 · Publicação no Telegram
• https://hackerone.com/reports/1923672 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1965 · Nota de Segurança
• https://t.me/cvenotify/49765 · Publicação no Telegram