CVE-2024-8648

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 16.0 through 17.3.6 GitLab CE/EE versions 17.4.0 through 17.4.3 GitLab CE/EE versions 17.5.0 through 17.5.1

Description The issue allows an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL. This could be exploited by a remote attacker to inject arbitrary JavaScript code.

Recommendations For GitLab CE/EE versions 16.0 through 17.3.6, update to version 17.3.7 or later. For GitLab CE/EE versions 17.4.0 through 17.4.3, update to version 17.4.4 or later. For GitLab CE/EE versions 17.5.0 through 17.5.1, update to version 17.5.2 or later.