MEDIUM
CVE-2024-7047
CVSS
5.4
Description
A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.
Summary dbcve.org
A stored cross-site scripting (XSS) vulnerability in GitLab CE/EE allows attackers to inject malicious scripts that execute in the context of authenticated users' sessions, potentially leading to session hijacking or actions performed on behalf of the user.
Mitigation
Upgrade GitLab to version 17.0.5 or later for the 17.x branch, 17.1.3 or later for the 17.1 branch, or 17.2.1 or later for the 17.2 branch to remediate this vulnerability.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.34%
Probability of exploitation in next 30 days
27.7th percentile
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.