MEDIUM

CVE-2019-6796

Gitlab GitLab 2019-04-11 CVSS v3.0

CVSS

6.1

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.5.8, 11.6.x before 11.6.6, and 11.7.x before 11.7.1. It allows XSS (issue 2 of 2). The user status field contains a lack of input validation and output encoding that results in a persistent XSS.

Summary dbcve.org

A persistent Cross-Site Scripting (XSS) vulnerability exists in GitLab Community and Enterprise Edition versions before 11.5.8, 11.6.6, and 11.7.1. The user status field lacks proper input validation and output encoding, allowing attackers to inject malicious scripts that execute in the browsers of other users viewing the status.

Mitigation

Upgrade GitLab to version 11.5.8, 11.6.6, 11.7.1 or later. Alternatively, implement input validation and proper output encoding on the user status field to sanitize malicious payloads.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

1.16%

Probability of exploitation in next 30 days

65.8th percentile

References

https://about.gitlab.com/2019/01/31/security-release-gitlab-11-dot-7-dot-3-released/ Release Notes, Vendor Advisory https://about.gitlab.com/2019/02/05/critical-security-release-gitlab-11-dot-7-dot-4-released/ Release Notes, Vendor Advisory https://gitlab.com/gitlab-org/gitlab-ce/issues/55320 https://gitlab.com/gitlab-org/gitlab-ce/issues/57112 Issue Tracking, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE