CVE-2020-12276 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
4.8MEDIUMNVD
EPSS
0.1%
top 70.21%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GitlabDebian Gitlab
Timeline
PublishedApr 29
Latest updateMay 24

Description

GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:NExploitability: 1.7 | Impact: 2.7

Affected Packages3 packages

▶NVDgitlab/gitlab9.5.9 — 12.7.8+2
▶debiandebian/gitlab< gitlab 13.2.3-2 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-m77g-m5w2-j2f3: GitLab 9↗2022-05-24
▶
OSV
CVE-2020-12276: GitLab 9↗2020-04-29
▶

📋Vendor Advisories

2
GitLab
CVE-2020-12276: GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification feature.↗2020-04-29
▶
Debian
CVE-2020-12276: gitlab - GitLab 9.5.9 through 12.9 is vulnerable to stored XSS in an admin notification f...↗2020
▶