CVE-2024-2177
Improper Restriction of Rendered UI Layers or Frames in GitLab
Summary
Improper Restriction of Rendered UI Layers or Frames in GitLab
Original description
The description as published by the source.
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
Affected packages
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"16.3.0"},{"fixed":"16.11.5"},{"introduced":"17.0.0"},{"fixed":"17.0.3"},{"introduced":"17.1.0"},{"fixed":"17.1.1"}]}]
References
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com
- report hackerone.com