CVE-2024-2177

Published: 9 July 2024

A Cross Window Forgery vulnerability exists within GitLab CE/EE affecting all versions from 16.3 prior to 16.11.5, 17.0 prior to 17.0.3, and 17.1 prior to 17.1.1. This condition allows for an attacker to abuse the OAuth authentication flow via a crafted payload.

Priority

Status

Package	Release	Status
gitlab Launchpad, Ubuntu, Debian	focal	Does not exist
	jammy	Does not exist
	mantic	Does not exist
	noble	Does not exist
	upstream	Needs triage
	xenial	Ignored (not maintainable)

References

https://www.cve.org/CVERecord?id=CVE-2024-2177
https://gitlab.com/gitlab-org/gitlab/-/issues/444467
https://hackerone.com/reports/2383443
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.