Under specialized conditions, GitLab may allow a user with an impersonation token to perform Git actions even if impersonation is disabled. This vulnerability is present in GitLab CE/EE versions before 13.12.9, 14.0.7, 14.1.2
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 13.1.0 (including) | 13.12.9 (excluding) |
| Gitlab | Gitlab | 14.0.0 (including) | 14.0.7 (excluding) |
| Gitlab | Gitlab | 14.1.0 (including) | 14.1.2 (excluding) |
| Gitlab | Ubuntu | esm-apps/xenial | * |
| Gitlab | Ubuntu | upstream | * |
Such a scenario is commonly observed when: