CVE-2020-26407 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 64.43%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
GitlabDebian GitlabGitlab CE EE+1 more
Timeline
PublishedDec 10
Latest updateMay 24

Description

A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶NVDgitlab/gitlab12.4.0 — 13.4.7+2
▶debiandebian/gitlab< gitlab 13.4.7-1 (sid)
▶gitlabgitlab/gitlab
▶CVEListV5gitlab/gitlab_ce_ee6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-79rf-9vhj-jq9w: A XSS vulnerability exists in Gitlab CE/EE from 12↗2022-05-24
▶
OSV
CVE-2020-26407: A XSS vulnerability exists in Gitlab CE/EE from 12↗2020-12-10
▶

📋Vendor Advisories

2
GitLab
CVE-2020-26407: A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cros↗2020-12-10
▶
Debian
CVE-2020-26407: gitlab - A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before ...↗2020
▶