CVE-2024-1211
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.
Summary dbcve.org
A cross-site request forgery vulnerability exists in GitLab CE/EE when configured to use JWT as an OmniAuth provider. Attackers could potentially trick authenticated users into performing unintended actions on the GitLab instance by leveraging the lack of proper CSRF protection on JWT authentication flows.
Mitigation
Update GitLab to version 16.9.7, 16.10.5, or 16.11.2 or later to patch this vulnerability. If immediate patching is not feasible, consider disabling the JWT OmniAuth provider or implementing additional CSRF token validation at the application layer.