GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
Why It Matters
Analysis dossierWhy It Matters
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, an unauthenticated user could have poisoned a shared cache's OAuth/OIDC discovery document to redirect certain flows to an externally controlled server, due to improper trust of user-supplied values when constructing endpoint URLs in cached discovery responses.
High
Unknown
Unknown
Risk basis: SOC ecosystem technology relevance; HIGH severity; Source severity; no confirmed exploitation signal
Affected Products & Remediation
1 source-backed product- gitlab gitlab · >= 18.3.0 < 19.3.6; >= 19.4.0 < 19.4.3; 19.5.0 · NVD CPE · Source
Vendor or catalog guidance (source)
Not provided by source
Known exploitation (source facts)
Only what a source states. Unknown means no source has said either way; it is not "not exploited".
- CISA KEV
- Unknown
- Exploited (source statement)
- Unknown
- Publicly disclosed (source)
- Unknown
Suggested hunting (rule-based inference)
SecOps Signal recommendation (rule-based inference). These steps are hunting hypotheses from the vulnerability class; they do not state or imply that exploitation occurred here or anywhere.
Matched user-interaction-client (CVSS AV:N, CVSS UI:R)
Exposure
- Identify endpoints reporting this CVE, especially those used for email and web browsing.Telemetry: DeviceTvmSoftwareVulnerabilities · A network vector that needs user interaction points at user-facing client software. · Rule user-interaction-client
Exploitation evidence
- Review unusual child processes started by the affected client application on affected endpoints.Telemetry: DeviceProcessEvents · Hunting hypothesis from the CVSS vector; it does not show that exploitation occurred. · Rule user-interaction-client
Response
- Confirm the source-stated update on affected endpoints.Telemetry: DeviceTvmSoftwareVulnerabilities · A follow-up inventory check verifies remediation. · Rule user-interaction-client
CISA KEV Record
CISA KEV status was not determined for this record.
Change History & Source Data
— No recorded material change
- CNA / source
- cve@gitlab.com
- Record status · verification
- UPDATED · NVD API
- CPE
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*, cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*, cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:community:*:*:*, cpe:2.3:a:gitlab:gitlab:19.5.0:*:*:*:enterprise:*:*:*
Evidence & Provenance
— No published hunting query names this record. Browse community and library queries instead.
Looking up related community queries…