CVE-2020-28452: Cross-Site Request Forgery (CSRF)

January 20, 2021 (updated January 27, 2021)

CSRF protection can be bypassed by forging a request that contains the same value for both the X-XSRF-TOKEN header and the XSRF-TOKEN cookie value, as the check in randomTokenCsrfProtection only checks that the two values are equal and non-empty.

References

nvd.nist.gov/vuln/detail/CVE-2020-28452

Code Behaviors & Features

Detect and mitigate CVE-2020-28452 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →