CVE-2024-12093

6.8 mediumEPSS 0.5%

Medium (6.8) in gitlab gitlab. EPSS 0.5% chance of exploitation in the next 30 days.

An issue has been discovered in GitLab CE/EE affecting all versions from 11.1 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. Improper XPath validation allows modified SAML response to bypass 2FA requirement under specialized conditions.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-1288
Published: 2025-05-22
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

gitlab:gitlab

References

https://gitlab.com/gitlab-org/gitlab/-/issues/507445
https://hackerone.com/reports/2851261

Check your stack JSON