CVE-2024-2177
Improper Restriction of Rendered UI Layers or Frames in GitLab
Résumé
Improper Restriction of Rendered UI Layers or Frames in GitLab
Description d'origine
La description telle que publiée par la source (souvent en anglais).
A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.
Paquets affectés
Bitnami
gitlab
[{"type":"SEMVER","events":[{"introduced":"16.3.0"},{"fixed":"16.11.5"},{"introduced":"17.0.0"},{"fixed":"17.0.3"},{"introduced":"17.1.0"},{"fixed":"17.1.1"}]}]
Références
- advisory nvd.nist.gov
- advisory github.com
- package git://git@gitlab.com:gitlab-org/gitlab.git
- report gitlab.com
- report hackerone.com