PT-2023-10703 · Gitlab · Gitlab Ce/Ee+1

Fransrosen · Published 2023-04-15 · Updated 2023-04-25 · CVE-2018-17537

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.7 and earlier, 11.2.x through 11.2.3, 11.3.x through 11.3.0

Description An issue was discovered in GitLab Community and Enterprise Edition, where blog-viewer has stored XSS during repository browsing, if package.json exists.

Recommendations For versions 11.1.7 and earlier, update to version 11.1.7 or later. For versions 11.2.x through 11.2.3, update to version 11.2.4 or later. For versions 11.3.x through 11.3.0, update to version 11.3.1 or later. As a temporary workaround, consider restricting access to the blog-viewer feature until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2018-17537

Affected Products

Gitlab

Gitlab Ce/Ee

References · 7

• https://osv.dev/vulnerability/CVE-2018-17537 · Vendor Advisory
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-17537 · Security Note
• https://t.me/cvenotify/48356 · Telegram Post
• https://t.me/cibsecurity/62249 · Telegram Post
• https://about.gitlab.com/blog/categories/releases · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17537 · Note