CVE-2019-9837: URL Redirection to Untrusted Site (Open Redirect)

March 21, 2019 (updated March 27, 2019)

Doorkeeper::OpenidConnect (aka the OpenID Connect extension for Doorkeeper) has an open redirect via the redirect_uri field in an OAuth authorization request (that results in an error response) with the openid scope and a prompt=none value. This allows phishing attacks against the authorization flow.

References

nvd.nist.gov/vuln/detail/CVE-2019-9837

Code Behaviors & Features

Detect and mitigate CVE-2019-9837 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →