PT-2023-17378 · Gitlab · Gitlab Ce/Ee+1

Bull · Published 2023-05-03 · Updated 2024-03-06 · CVE-2023-1965

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab EE versions 14.2 through 15.9.5 GitLab EE versions 15.10 through 15.10.4 GitLab EE versions 15.11 through 15.11.0

Description An issue has been discovered in GitLab EE, where a lack of verification on the RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature is not enabled by default.

Recommendations For GitLab EE versions 14.2 through 15.9.5, update to version 15.9.6 or later. For GitLab EE versions 15.10 through 15.10.4, update to version 15.10.5 or later. For GitLab EE versions 15.11 through 15.11.0, update to version 15.11.1 or later. As a temporary workaround, consider restricting access to the RelayState parameter to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BIT-GITLAB-2023-1965

CVE-2023-1965

Affected Products

Gitlab

Gitlab Ce/Ee

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1965.json · Exploit
• https://osv.dev/vulnerability/BIT-gitlab-2023-1965 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1965 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1965 · Security Note
• https://t.me/cvenotify/50083 · Telegram Post
• https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1965.json · Note
• https://gitlab.com/gitlab-org/gitlab/-/issues/406235 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1965 · Note
• https://t.me/cibsecurity/63249 · Telegram Post
• https://hackerone.com/reports/1923672 · Note
• https://t.me/cvenotify/49765 · Telegram Post