CVE-2024-4597

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions from 16.7 before 16.9.7, all versions starting from 16.10 before 16.10.5, all versions starting from 16.11 before 16.11.2. An attacker could force a user with an active SAML session to approve an MR via CSRF.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: May 14, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-459709.8Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit ac925fae8e281ac6defcd630e9dd756264e9c5bc allow a mali CVE-2024-459719.8Multiple Buffer overflows in the MMS Client in MZ Automation LibIEC61850 before commit 1f52be9ddeae00e69cd43e4cac3cb4f0c880c4f0 allow a mali CVE-2024-459798.8A host header injection vulnerability in Lines Police CAD 1.0 allows attackers to obtain the password reset token via user interaction with CVE-2024-45986.5An information disclosure vulnerability exists in multiple WSO2 products due to improper implementation of the enrich mediator. Authenticate CVE-2024-459808.8A host header injection vulnerability in MEANStore 1.0 allows attackers to obtain the password reset token via user interaction with a craft CVE-2024-459818.8A host header injection vulnerability in BookReviewLibrary 1.0 allows attackers to obtain the password reset token via user interaction with CVE-2024-459828.8A host header injection vulnerability in scheduleR v0.0.18 allows attackers to obtain the password reset token via user interaction with a c CVE-2024-459836.3A Cross-Site Request Forgery (CSRF) vulnerability exists in kishan0725's Hospital Management System version 6.3.5. The vulnerability allows CVE-2024-459844.7A Cross Site Scripting (XSS) vulnerability in add_donor.php of Blood Bank And Donation Management System 1.0 allows an attacker to inject ma CVE-2024-459854.7A Cross Site Scripting (XSS) vulnerability in update_contact.php of Blood Bank and Donation Management System v1.0 allows an attacker to inj CVE-2024-459865.4A stored Cross-Site Scripting (XSS) vulnerability was identified in Projectworld Online Voting System 1.0 that occurs when an account is reg CVE-2024-459876.5Projectworld Online Voting System Version 1.0 is vulnerable to Cross Site Request Forgery (CSRF) via voter.php. This vulnerability allows an