PT-2017-18520 · Gitlab · Gitlab

Publicado 2017-05-04 · Atualizado 2017-05-15 · CVE-2017-8778

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 8.14.9 GitLab versions 8.15.x prior to 8.15.6 GitLab versions 8.16.x prior to 8.16.5

Description The issue is related to a scripting element in an SVG document that can be used to exploit an XSS vulnerability. This can occur when the element is used in an issue attachment or avatar.

Recommendations For GitLab versions prior to 8.14.9, update to version 8.14.9 or later. For GitLab versions 8.15.x prior to 8.15.6, update to version 8.15.6 or later. For GitLab versions 8.16.x prior to 8.16.5, update to version 8.16.5 or later.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-8778

Produtos afetados

Gitlab

Referências · 4

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/27471 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-8778 · Nota de Segurança
• https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8778 · Aviso do Fabricante