GitLab Issues Security Patch for Critical Account Takeover Vulnerability

GitLab has moved to address a critical security flaw in its provider that, if effectively exploited, could final result in an account takeover.

Tracked as CVE-2022-1680, the issue has a CVSS severity score of 9.9 and was found internally by the firm. The security flaw impacts all variations of GitLab Enterprise Version (EE) setting up from 11.10 prior to 14.9.5, all variations starting off from 14.10 before 14.10.4, and all versions starting from 15. in advance of 15..1.

“When team SAML SSO is configured, the SCIM attribute (available only on Premium+ subscriptions) could make it possible for any proprietor of a Top quality group to invite arbitrary end users by their username and email, then adjust those people users’ email addresses by way of SCIM to an attacker controlled email handle and as a result — in the absence of 2FA — get in excess of all those accounts,” GitLab reported.

Getting attained this, a malicious actor can also adjust the display screen title and username of the focused account, the DevOps system company cautioned in its advisory printed on June 1, 2022.

Also settled by GitLab in versions 15..1, 14.10.4, and 14.9.5 are seven other security vulnerabilities, two of which are rated higher, 4 are rated medium, and 1 is rated very low in severity.

Customers jogging an afflicted installation of the aforementioned bugs are advised to improve to the most recent variation as before long as achievable.

Observed this posting interesting? Adhere to THN on Facebook, Twitter  and LinkedIn to go through more distinctive content we article.

Some parts of this post are sourced from:
thehackernews.com