CVE-2023-1279
Description
An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5, all versions starting from 16.3 before 16.3.1 where it was possible to create a URL that would redirect to a different project.
Summary dbcve.org
GitLab versions 4.1 through 16.3.0 contain an open redirect vulnerability where a crafted URL can redirect users to a different project than the one displayed in the URL. This allows attackers to trick users into visiting malicious sites by manipulating the redirect target in the URL.
Mitigation
Upgrade to GitLab version 16.1.5, 16.2.5, 16.3.1, or later. Alternatively, implement server-side validation to ensure redirect URLs remain within the same project domain before allowing the redirect.