Gitlab · Gitlab Ce/Ee · CVE-2024-9387
**Name of the Vulnerable Software and Affected Versions**
GitLab CE/EE versions 11.8 through 17.4.6
GitLab CE/EE versions 17.5 through 17.5.4
GitLab CE/EE versions 17.6 through 17.6.2
**Description**
The issue is related to an open redirect vulnerability in a GitLab CE/EE API endpoint. This could allow an attacker to perform phishing attacks by redirecting users to an untrusted site. The vulnerability may be exploited remotely.
**Recommendations**
For GitLab CE/EE versions 11.8 through 17.4.6, update to a version after 17.4.6.
For GitLab CE/EE versions 17.5 through 17.5.4, update to a version after 17.5.4.
For GitLab CE/EE versions 17.6 through 17.6.2, update to a version after 17.6.2.
As a temporary workaround, consider restricting access to the affected API endpoint until a patch is available.