MEDIUM

CVE-2023-1965

Gitlab GitLab 2023-05-03 CVSS v3.1

CVSS

6.5

Description

An issue has been discovered in GitLab EE affecting all versions starting from 14.2 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. Lack of verification on RelayState parameter allowed a maliciously crafted URL to obtain access tokens granted for 3rd party Group SAML SSO logins. This feature isn't enabled by default.

Summary dbcve.org

GitLab EE fails to validate the RelayState parameter in SAML Group SSO login flows. An attacker can craft a malicious URL that manipulates or captures access tokens during the SAML authentication process for group memberships.

Mitigation

Upgrade GitLab to version 15.9.6, 15.10.5, 15.11.1 or later. Verify if Group SAML SSO is enabled and audit for suspicious authentication activity.

Weakness (CWE)

CWE-352 Cross-Site Request Forgery (CSRF)

EPSS Score

0.43%

Probability of exploitation in next 30 days

36.9th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1965.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/406235 Broken Link https://hackerone.com/reports/1923672 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE