CVE-2023-7045
Assigner: GitLab
Published: 2024-05-23T11:02:26.796Z
State: PUBLISHED
title: Cross-Site Request Forgery (CSRF) in GitLab
descriptions: value: A CSRF vulnerability exists within GitLab CE/EE from versions 13.11 before 16.10.6, from 16.11 before 16.11.3, from 17.0 before 17.0.1. By leveraging this vulnerability, an attacker could exfiltrate anti-CSRF tokens via the Kubernetes Agent Server (KAS).
affected: vendor: GitLab
product: GitLab
repo: git://git@gitlab.com:gitlab-org/gitlab.git
versions: version: 13.11
status: affected
lessThan: 16.10.6
versionType: semver
version: 16.11
status: affected
lessThan: 16.11.3
versionType: semver
version: 17.0
status: affected
lessThan: 17.0.1
versionType: semver
defaultStatus: unaffected
problemTypes: descriptions: description: CWE-352: Cross-Site Request Forgery (CSRF)
cweId: CWE-352
type: CWE
metrics: format: CVSS
scenarios: value: GENERAL
cvssV3_1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 5.4
baseSeverity: MEDIUM
solutions: value: Upgrade to versions 16.10.6, 16.11.3, 17.0.1 or above.
credits: value: Thanks [imrerad](https://hackerone.com/imrerad) for reporting this vulnerability through our HackerOne bug bounty program
type: finder