MEDIUM
CVE-2023-0042
CVSS
6.1
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2. GitLab Pages allows redirection to arbitrary protocols.
Summary dbcve.org
GitLab Pages contains an open redirect vulnerability that allows redirection to arbitrary protocols (such as javascript:, data:, or other potentially dangerous URL schemes). This occurs due to insufficient validation of redirect URLs in the Pages feature, enabling attackers to craft malicious redirects for phishing or bypass security controls.
Mitigation
Upgrade GitLab to version 15.5.7, 15.6.4, or 15.7.2 or later. If GitLab Pages is not required in the environment, it can be disabled as a compensating control.
Weakness (CWE)
CWE-601
Open Redirect
EPSS Score
0.4%
Probability of exploitation in next 30 days
34.4th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.