CVE-2024-11274

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-11274
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11274.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-11274
Aliases
Downstream
Related
Published
2024-12-12T12:02:20.019Z
Modified
2026-02-01T12:13:02.676612Z
Severity
  • 8.7 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N CVSS Calculator
Summary
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
Details

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.1 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, injection of NEL headers in k8s proxy response could lead to session data exfiltration.

Database specific 
{
    "cwe_ids": [
        "CWE-601"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11274.json",
    "cna_assigner": "GitLab"
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4961ad113f3afe23965ac12285eaab31315ab0c6
Fixed
25a55583bbcf724ad625848d48a529467e7c7097
Database specific 
{
    "versions": [
        {
            "introduced": "16.1"
        },
        {
            "fixed": "17.4.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
173959793c1163052d16c2158773ea9504aa712e
Fixed
0397324ed14bb7f0ede422841d713fd22349302f
Database specific 
{
    "versions": [
        {
            "introduced": "17.5"
        },
        {
            "fixed": "17.5.4"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
a8830741d3c4ad7f6a70eed38ee7af31f298d093
Fixed
6ff444aad3a327c384b0859be326d042dde090ee
Database specific 
{
    "versions": [
        {
            "introduced": "17.6"
        },
        {
            "fixed": "17.6.2"
        }
    ]
}

Affected versions

v17.*
v17.5.0-ee
v17.5.1-ee
v17.5.2-ee
v17.5.3-ee
v17.6.0-ee
v17.6.1-ee
v17.6.2-rc30-ee
v17.6.2-rc31-ee

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-11274.json"