CVE-2024-2177

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

EPSS

0.65% chance of exploitation in the next 30 days, 49th percentile

Published

2024-07-09

Updated

2024-09-17

Proof-of-concept exploits (2)

• https://gitlab.com/gitlab-org/gitlab/-/issues/444467
• https://hackerone.com/reports/2383443

References

• CVE Record
• NVD entry

Related

• CVE-2024-21762
• CVE-2024-21773
• CVE-2024-2176
• CVE-2024-21793
• CVE-2024-21754
• CVE-2024-2180