CVE-2024-8180

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.3 through 17.3.6 GitLab CE/EE versions 17.4 through 17.4.3 GitLab CE/EE versions 17.5 through 17.5.1

Description An issue has been discovered in GitLab CE/EE where improper output encoding could lead to XSS if CSP is not enabled. This could allow a remote attacker to conduct a cross-site scripting attack.

Recommendations For GitLab CE/EE versions 17.3 through 17.3.6, update to version 17.3.7 or later. For GitLab CE/EE versions 17.4 through 17.4.3, update to version 17.4.4 or later. For GitLab CE/EE versions 17.5 through 17.5.1, update to version 17.5.2 or later. As a temporary workaround, consider enabling CSP to minimize the risk of exploitation.