Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') in GitLab
Résumé
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interact...
Résumé généré automatiquement
Assemblé par SecPulse à partir des données sources (CVSS, CWE, versions affectées) à l'aide de modèles, sans IA. Vérifiez la description d'origine et les références ci-dessous.
OmniAuth SAMLとLDAPの自動リンクが両方有効な環境で、認証済みの利用者が標的のユーザーの操作なしに既存のLDAP連携アカウントを乗っ取れる脆弱性です。影響を受けるのはGitLab CE/EEの10.1以降で19.3.6より前、19.4系は19.4.3より前、19.5系は19.5.1より前のバージョンです。修正版として19.5.1、19.4.3、19.3.6などが公開されているため、最新版へ更新してください。
Paquets affectés
| Écosystème | Paquet | Concernées | Corrigé |
|---|---|---|---|
| GitLab | GitLab |
≥ 10.1, < 19.3.6 ≥ 19.4, < 19.4.3 ≥ 19.5, < 19.5.1 |
19.3.6 19.4.3 19.5.1 |
Description d'origine La description telle que publiée par la source (souvent en anglais).
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, when OmniAuth SAML and LDAP auto-linking were both enabled, an authenticated user could have taken over an existing LDAP-backed account without any interaction from the targeted user, due to improper input sanitization in the LDAP email lookup path used during OmniAuth identity linking.
Source: GitLab Security Releases NVD
Références
- web cve@gitlab.com
- web cve@gitlab.com
- web cve@gitlab.com