CVE-2018-10379 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting6 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 80.92%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedMay 31
Latest updateMay 14

Description

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages3 packages

▶NVDgitlab/gitlab10.6.0 — 10.6.5+2
▶debiandebian/gitlab< gitlab 10.6.5+dfsg-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-v6wj-hx5h-fhwp: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10↗2022-05-14
▶

📋Vendor Advisories

2
GitLab
CVE-2018-10379: An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. Th↗2018-05-31
▶
Debian
CVE-2018-10379: gitlab - An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition ...↗2018
▶

💬Community

2
HackerOne
Persistent XSS - Selecting users as allowed merge request approvers↗2018-07-16
▶
HackerOne
XSS (Persistent) - Selecting role(s) for protected branches↗2018-07-16
▶