An issue discovered in GitLab CE/EE affecting all versions from 16.11 prior to 17.6.5, 17.7 prior to 17.7.4, and 17.8 prior to 17.8.2 meant that long-lived connections in ActionCable potentially allowed revoked Personal Access Tokens access to streaming results.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Gitlab | Gitlab | 16.11.0 (including) | 17.6.5 (excluding) |
| Gitlab | Gitlab | 17.7.0 (including) | 17.7.4 (excluding) |
| Gitlab | Gitlab | 17.8.0 (including) | 17.8.2 (excluding) |
| Gitlab | Ubuntu | esm-apps/xenial | * |