A privilege escalation issue was discovered in GitLab CE/EE 9.0 and later when trigger tokens are not rotated once ownership of them has changed.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 9.0.0 (including) | 11.11.7 (excluding) |
Potential Mitigations
References
- https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
- https://gitlab.com/gitlab-org/gitlab-ce/issues/58312
- https://hackerone.com/reports/495282
- https://about.gitlab.com/releases/2019/07/29/security-release-gitlab-12-dot-1-dot-2-released/
- https://gitlab.com/gitlab-org/gitlab-ce/issues/58312
- https://hackerone.com/reports/495282