PT-2018-5144 · Gitlab · Gitlab Ce/Ee+1

Published 2018-03-18 · Updated 2019-10-09 · CVE-2017-0917

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.2.4

Description The issue is related to a lack of input validation in the CI job component, resulting in persistent cross-site scripting. This allows for malicious scripts to be injected and executed, potentially leading to unauthorized access or data theft.

Recommendations For Gitlab Community Edition version 10.2.4, consider disabling the CI job component until a patch is available to prevent exploitation of the lack of input validation. Restrict access to the CI job component to minimize the risk of persistent cross-site scripting attacks.

Fix

RCE

XSS

Weakness Enumeration

CWE-20

CWE-79

Related Identifiers

CVE-2017-0917

DSA-4145-1

Affected Products

Gitlab

Gitlab Ce/Ee

References · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0926 · Security Note
• https://security-tracker.debian.org/tracker/source-package/gitlab · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0915 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0917 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-4145-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4145-1 · Vendor Advisory
• https://debian.org/security/2018/dsa-4145 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Security Note
• https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0925 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0917 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0917 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3710 · Security Note
• https://gitlab.com/gitlab-org/gitlab-ce/issues/32198 · Note