CVE-2024-4283
Description
An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth flow.
Summary dbcve.org
An open redirect vulnerability exists in GitLab EE's OAuth authentication flow across versions 11.1 through 17.1.7, 17.2.x before 17.2.5, and 17.3.x before 17.3.2. Under specific conditions, an attacker could manipulate the OAuth redirect flow to hijack session tokens or authorization codes, potentially leading to account takeover.
Mitigation
Upgrade GitLab EE to version 17.1.7, 17.2.5, 17.3.2 or later. For production environments, schedule maintenance window, backup data, test upgrade in staging, and verify OAuth functionality post-upgrade.