CVE-2022-3486 - An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL

Back Back to CVE browser

MEDIUM

An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL

Published Nov 9, 2022

6.1

MEDIUM

CVSS 3.1

EPSS 0.78%

Description

An open redirect vulnerability in GitLab EE/CE affecting all versions from 9.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2, allows an attacker to redirect users to an arbitrary location if they trust the URL.

Affected products

Vendor GitLab Product GitLab Default
n/a
- Version
  >=15.4, <15.4.4
  Status
  affected
  Constraints
  -
- Version
  >=15.5, <15.5.2
  Status
  affected
  Constraints
  -
- Version
  >=9.4, <15.3.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GitLab

n/a

Version	Status	Constraints
>=15.4, <15.4.4	affected	-
>=15.5, <15.5.2	affected	-
>=9.4, <15.3.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (3)

https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377810
Broken Link
https://hackerone.com/reports/1725190
Permissions RequiredThird Party Advisory

Link	Providers	Tags
https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3486.json		Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/377810		Broken Link
https://hackerone.com/reports/1725190		Permissions RequiredThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner GitLab

Published Nov 9, 2022

Updated May 1, 2025

Reserved Oct 13, 2022

Link CVE-2022-3486

CISA Vulnrichment

Updated May 1, 2025

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2022-3486

Red Hat

Severity n/a

Public date n/a

Links CVE-2022-3486