MEDIUM

CVE-2018-17454

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

5.4

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the issue details screen.

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability in GitLab Community and Enterprise Edition allows attackers to inject malicious JavaScript into issue content. This script executes in the browsers of other users who view the affected issue details screen.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later to remediate this stored XSS vulnerability.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.3th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE