MEDIUM

CVE-2018-17537

Gitlab GitLab 2023-04-16 CVSS v3.1

CVSS

5.4

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .

Summary dbcve.org

This is a stored XSS vulnerability in GitLab's blog-viewer feature. When a repository contains a package.json file, the blog-viewer fails to properly sanitize content, allowing attackers to inject malicious JavaScript that executes when other users browse the repository.

Mitigation

Upgrade GitLab to version 11.1.7, 11.2.4, 11.3.1 or later to patch the stored XSS vulnerability in the blog-viewer component.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.4%

Probability of exploitation in next 30 days

34.3th percentile

References

https://about.gitlab.com/blog/categories/releases/ Release Notes https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/ Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE