PT-2018-9860 · Gitlab · Gitlab Ce/Ee+1

Published 2018-05-31 · Updated 2018-06-29 · CVE-2018-10379

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: GitLab Community Edition (CE) versions 10.5.x through 10.5.7 GitLab Community Edition (CE) versions 10.6.x through 10.6.4 GitLab Community Edition (CE) versions 10.7.x through 10.7.1 GitLab Enterprise Edition (EE) versions 10.5.x through 10.5.7 GitLab Enterprise Edition (EE) versions 10.6.x through 10.6.4 GitLab Enterprise Edition (EE) versions 10.7.x through 10.7.1

Description: The issue is related to a persistent XSS vulnerability in the Move Issue feature.

Recommendations: For GitLab Community Edition (CE) versions 10.5.x through 10.5.7, update to version 10.5.8 or later. For GitLab Community Edition (CE) versions 10.6.x through 10.6.4, update to version 10.6.5 or later. For GitLab Community Edition (CE) versions 10.7.x through 10.7.1, update to version 10.7.2 or later. For GitLab Enterprise Edition (EE) versions 10.5.x through 10.5.7, update to version 10.5.8 or later. For GitLab Enterprise Edition (EE) versions 10.6.x through 10.6.4, update to version 10.6.5 or later. For GitLab Enterprise Edition (EE) versions 10.7.x through 10.7.1, update to version 10.7.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-10379

Affected Products

Gitlab

Gitlab Ce/Ee

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-10379 · Security Note
• https://osv.dev/vulnerability/CVE-2018-10379 · Vendor Advisory
• https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10379 · Note
• http://securityfocus.com/bid/104491 · Note
• https://about.gitlab.com/releases/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released · Note