PT-2025-22486 · Gitlab · Gitlab Ce/Ee

Published 2025-05-22 · Updated 2025-06-09 · CVE-2024-12093

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 11.1 through 17.10.6 GitLab CE/EE versions 17.11 through 17.11.2 GitLab CE/EE versions 18.0 through 18.0.0

Description An issue has been discovered in GitLab CE/EE, where improper XPath validation allows a modified SAML response to bypass the 2FA requirement under specialized conditions.

Recommendations For versions 11.1 through 17.10.6, update to version 17.10.7 or later. For versions 17.11 through 17.11.2, update to version 17.11.3 or later. For versions 18.0 through 18.0.0, update to version 18.0.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-1288

Related Identifiers

BIT-GITLAB-2024-12093

CVE-2024-12093

Affected Products

Gitlab Ce/Ee

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/12xxx/CVE-2024-12093.json · Exploit
• 🔥 https://hackerone.com/reports/2851261 · Exploit
• 🔥 https://gitlab.com/gitlab-org/gitlab/-/issues/507445 · Exploit
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-12093 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-12093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-12093 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-12093 · Security Note
• https://osv.dev/vulnerability/CVE-2024-12093 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2024-12093 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925565849005330547 · Twitter Post