Executive Summary

This vulnerability in GitLab CE/EE versions before 18.8.7, 18.9.3, and 18.10.1 allows an unauthenticated user to bypass WebAuthn two-factor authentication. The issue arises due to inconsistent input validation during the authentication process, which could enable unauthorized access to user accounts.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to user accounts without needing to pass the WebAuthn two-factor authentication. This compromises account security, potentially exposing sensitive information and allowing attackers to impersonate legitimate users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade your GitLab CE/EE instance to a fixed version. Specifically, update to version 18.8.7 or later if you are on the 18.8 branch, 18.9.3 or later if on the 18.9 branch, or 18.10.1 or later if on the 18.10 branch. These versions contain the fix that prevents unauthenticated users from bypassing WebAuthn two-factor authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated user to bypass WebAuthn two-factor authentication and gain unauthorized access to user accounts. Such unauthorized access could lead to exposure or compromise of sensitive personal or protected health information, potentially impacting compliance with standards like GDPR and HIPAA that require strong access controls and protection of user data.

However, specific impacts on compliance with these regulations are not detailed in the provided information.

Useful 0 Not Useful 0