PT-2023-10703 · Gitlab · Gitlab Ce/Ee+1

Fransrosen · Publicado 2023-04-15 · Atualizado 2023-04-25 · CVE-2018-17537

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.7 and earlier, 11.2.x through 11.2.3, 11.3.x through 11.3.0

Description An issue was discovered in GitLab Community and Enterprise Edition, where blog-viewer has stored XSS during repository browsing, if package.json exists.

Recommendations For versions 11.1.7 and earlier, update to version 11.1.7 or later. For versions 11.2.x through 11.2.3, update to version 11.2.4 or later. For versions 11.3.x through 11.3.0, update to version 11.3.1 or later. As a temporary workaround, consider restricting access to the blog-viewer feature until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2018-17537

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 7

• https://osv.dev/vulnerability/CVE-2018-17537 · Aviso do Fabricante
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Aviso do Fabricante
• https://t.me/cvenotify/48356 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2018-17537 · Nota de Segurança
• https://t.me/cibsecurity/62249 · Publicação no Telegram
• https://about.gitlab.com/blog/categories/releases · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17537 · Nota