CVE-2024-11274CWE-601

URL Redirection to Untrusted Site ('Open Redirect') in GitLab

High · published December 12, 2024

CVSS v3.1
8.7
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2024-12-12T12:02Z
EPSS history
Timeline
  • 12 DEC 12:02Z
    URL Redirection to Untrusted Site ('Open Redirect') in GitLab
    cvelistv5