MEDIUM

CVE-2020-10076

Gitlab GitLab 2020-03-13 CVSS v3.1

CVSS

6.1

Description

GitLab 12.1 through 12.8.1 allows XSS. A stored cross-site scripting vulnerability was discovered when displaying merge requests.

Summary dbcve.org

Stored cross-site scripting (XSS) vulnerability in GitLab versions 12.1 through 12.8.1 allows attackers to inject malicious JavaScript payloads into merge request fields (titles, descriptions, or comments) that execute in the browsers of other users viewing those merge requests.

Mitigation

Upgrade GitLab to version 12.8.2 or later to receive the security patch. If immediate upgrade is not possible, restrict merge request creation privileges to trusted users and implement Content Security Policy headers as a compensating control.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.69%

Probability of exploitation in next 30 days

51.4th percentile

References

https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/ Release Notes, Vendor Advisory https://about.gitlab.com/releases/2020/03/04/gitlab-12-dot-8-dot-2-released/index.html Release Notes, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE