PT-2024-8696

CVE-2024-8180

Published

2024-11-13

Updated

2024-12-13

Description by

CVSS 2.0

5.5

Medium

MetricsAV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab CE/EE versions 17.3 through 17.3.6 GitLab CE/EE versions 17.4 through 17.4.3 GitLab CE/EE versions 17.5 through 17.5.1

Description An issue has been discovered in GitLab CE/EE where improper output encoding could lead to XSS if CSP is not enabled. This could allow a remote attacker to conduct a cross-site scripting attack.

Recommendations For GitLab CE/EE versions 17.3 through 17.3.6, update to version 17.3.7 or later. For GitLab CE/EE versions 17.4 through 17.4.3, update to version 17.4.4 or later. For GitLab CE/EE versions 17.5 through 17.5.1, update to version 17.5.2 or later. As a temporary workaround, consider enabling CSP to minimize the risk of exploitation.

Exploitability

Exploit

Fix

Impacts

Researchers

Joaxcar

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2024-8180