MEDIUM
CVE-2024-8180
CVSS
5.4
Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.
Summary dbcve.org
GitLab CE/EE versions 17.3.x before 17.3.7, 17.4.x before 17.4.4, and 17.5.x before 17.5.2 contain an improper output encoding vulnerability that could lead to stored XSS if Content Security Policy (CSP) is not enabled.
Mitigation
Upgrade to GitLab versions 17.3.7, 17.4.4, or 17.5.2 or later, or ensure Content Security Policy is enabled as a compensating control.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
0.36%
Probability of exploitation in next 30 days
29.7th percentile
References
https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released/#html-injection-in-vulnerability-code-flow-could-lead-to-xss-on-self-hosted-instances
Vendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/480720
Broken Link
https://hackerone.com/reports/2654010
Permissions Required
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.