An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://gitlab.com/gitlab-org/gitlab/-/issues/507445 | Exploit Issue Tracking |
| https://hackerone.com/reports/2851261 | Permissions Required |
Configurations
Configuration 1 (hide)
|
History
08 Aug 2025, 18:37
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gitlab.com/gitlab-org/gitlab/-/issues/507445 - Exploit, Issue Tracking | |
| References | () https://hackerone.com/reports/2851261 - Permissions Required | |
| First Time |
Gitlab gitlab
Gitlab |
|
| CPE | cpe:2.3:a:gitlab:gitlab:18.0.0:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:* cpe:2.3:a:gitlab:gitlab:18.0.0:*:*:*:community:*:*:* |
22 May 2025, 15:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-22 15:16
Updated : 2025-08-08 18:37
NVD link : CVE-2024-12093
Mitre link : CVE-2024-12093
JSON object : View
Products Affected
gitlab
- gitlab
CWE
CWE-1288
Improper Validation of Consistency within Input