CVE-2023-6680
Description
An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 prior to 16.5.4, and 16.6 prior to 16.6.2 allows an attacker to authenticate as another user given their public key if they use Smartcard authentication. Smartcard authentication is an experimental feature and has to be manually enabled by an administrator.
Summary dbcve.org
GitLab EE fails to properly validate certificates during Smartcard authentication, allowing an attacker with a target user's public key to authenticate as that user. This is a classic improper certificate validation vulnerability (CWE-295) in the experimental Smartcard authentication feature.
Mitigation
Upgrade GitLab to version 16.4.4, 16.5.4, or 16.6.2 or later. If Smartcard authentication is not required, disable this experimental feature until the upgrade can be performed.