Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.4
CVE-2024-1211: GitLab allows forged requests when using JWT login
CVE-2024-1211 · published 1 year ago
Summary
GitLab versions that use JWT for single sign‑on could let an attacker trick a logged‑in user into performing actions without their knowledge. This could lead to unauthorized changes or data exposure. Update GitLab to the latest release that includes the fix or change the authentication method away from JWT.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| gitlab | gitlab |
>= 10.6.0, < 16.9.7 >= 16.10.0, < 16.10.5 >= 16.11.0, < 16.11.2 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Cross-Site Request Forgery (CSRF) in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.6 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2 in which cross-site request forgery may have been possible on GitLab instances configured to use JWT as an OmniAuth provider.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/1xxx/CVE-2024-1211.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-1211 Vendor Advisory
- https://hackerone.com/reports/2323594 Third Party Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/440313 Third Party Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-352Cross-Site Request Forgery (CSRF)
Timeline
Published30 Jan 2025
Updated4 Nov 2026
First seen7 Mar 2026
Track software like this
Free during beta