CVE-2024-4597: 
GitLab vulnerability analysis and mitigation

An issue has been discovered in GitLab Enterprise Edition (EE) affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, and all versions starting from 16.11 before 16.11.2. The vulnerability allows an attacker to force a user with an active SAML session to approve a Merge Request (MR) via Cross-Site Request Forgery (CSRF) (GitLab Release, NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue, identified as CWE-352. It has been assigned a CVSS v3.1 base score of 5.7 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N. The vulnerability specifically affects the SAML SSO functionality in GitLab EE (NVD).

When successfully exploited, an attacker could force a user with an active SAML session to approve a Merge Request without their explicit consent. This could lead to unauthorized code changes being approved in the system (GitLab Release).

The vulnerability requires network access and user interaction to be exploited. The attacker needs low privileges to execute the attack, but user interaction is required for successful exploitation (NVD).

GitLab has released patches to address this vulnerability in versions 16.9.7, 16.10.5, and 16.11.2. Users are strongly recommended to upgrade to these patched versions immediately. GitLab.com is already running the patched version (GitLab Release).

The vulnerability was discovered and reported internally by a GitLab team member named joernchen, demonstrating GitLab's internal security review processes (GitLab Release).