PT-2024-6674 · Gitlab · Gitlab Ce/Ee+1

Yvvdwf · Published 2024-05-15 · Updated 2024-07-01 · CVE-2024-4901

Positive Technologies (AI Summary)

CVSS v3.1

8.7

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.9 through 16.11.5 GitLab CE/EE versions 17.0 through 17.0.3 GitLab CE/EE versions 17.1 through 17.1.1

Description: The issue is related to a stored XSS vulnerability that can be imported from a project with malicious commit notes, potentially allowing an attacker to conduct cross-site scripting attacks. This could enable a remote attacker to perform intersite script attacks by exploiting the lack of protection measures for the web page structure.

Recommendations: For versions 16.9 through 16.11.5, update to version 16.11.5 or later. For versions 17.0 through 17.0.3, update to version 17.0.3 or later. For versions 17.1 through 17.1.1, update to version 17.1.1 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-07880

BIT-GITLAB-2024-4901

CVE-2024-4901

Affected Products

Gitlab

Gitlab Ce/Ee

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/4xxx/CVE-2024-4901.json · Exploit
• 🔥 https://hackerone.com/reports/2500163 · Exploit
• https://bdu.fstec.ru/vul/2024-07880 · Security Note
• https://ubuntu.com/security/CVE-2024-4901 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-4901 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-4901 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-4901 · Security Note
• https://osv.dev/vulnerability/CVE-2024-4901 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-gitlab-2024-4901 · Vendor Advisory
• https://t.me/echeloneyes/2903 · Telegram Post
• https://t.me/true_secator/5912 · Telegram Post
• https://gitlab.com/gitlab-org/gitlab/-/issues/461773 · Note
• https://about.gitlab.com/releases/2024/06/26/patch-release-gitlab-17-1-1-released · Note
• https://cybersecurity-help.cz/vdb/SB2024062719 · Note
• https://thehackernews.com/2024/06/gitlab-releases-patch-for-critical-cicd.html · Note