PT-2024-8696 · Gitlab · Gitlab Ce/Ee+1

Joaxcar

·

Published

2024-11-13

·

Updated

2024-12-13

·

CVE-2024-8180

CVSS v2.0

5.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:N
Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.3 through 17.3.6 GitLab CE/EE versions 17.4 through 17.4.3 GitLab CE/EE versions 17.5 through 17.5.1
Description An issue has been discovered in GitLab CE/EE where improper output encoding could lead to XSS if CSP is not enabled. This could allow a remote attacker to conduct a cross-site scripting attack.
Recommendations For GitLab CE/EE versions 17.3 through 17.3.6, update to version 17.3.7 or later. For GitLab CE/EE versions 17.4 through 17.4.3, update to version 17.4.4 or later. For GitLab CE/EE versions 17.5 through 17.5.1, update to version 17.5.2 or later. As a temporary workaround, consider enabling CSP to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2024-10298
BIT-GITLAB-2024-8180
CVE-2024-8180

Affected Products

Gitlab
Gitlab Ce/Ee