CVE-2024-12093

MEDIUM

6.8

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.

CVE Details

CVSS v3.1 Score6.8

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack VectorNETWORK

ComplexityHIGH

Privileges RequiredLOW

User InteractionNONE

Published5/22/2025

Last Modified8/8/2025

Sourcenvd

Honeypot Sightings0

Affected Products

gitlab:gitlab

Weaknesses (CWE)

CWE-1288

References

https://gitlab.com/gitlab-org/gitlab/-/issues/507445(cve@gitlab.com)

https://hackerone.com/reports/2851261(cve@gitlab.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.