CVE-2018-18643 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.1%
top 73.38%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedApr 25
Latest updateMay 24

Description

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages4 packages

▶NVDgitlab/gitlab11.3.0 — 11.3.10+4
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

Patches

Patch: gitlab.com ↗Patch: gitlab.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-6gjc-rr77-h8h6: GitLab CE & EE 11↗2022-05-24
▶

📋Vendor Advisories

2
GitLab
CVE-2018-18643: GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.↗2019-04-25
▶
Debian
CVE-2018-18643: gitlab - GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have P...↗2018
▶