MEDIUM

CVE-2018-17536

Gitlab GitLab 2023-04-15 CVSS v3.1

CVSS

5.4

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. There is stored XSS on the merge request page via project import.

Summary dbcve.org

A stored cross-site scripting (XSS) vulnerability exists in GitLab Community and Enterprise Edition. The vulnerability allows injection of malicious scripts through the project import feature, which are then rendered on the merge request page. An attacker could exploit this to execute arbitrary JavaScript in the browsers of users viewing affected merge requests.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1, or later. Alternatively, restrict or disable the project import feature for untrusted users until patching can be performed.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.3th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE