CVE-2024-8186 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting4 documents4 sources
Severity
5.4MEDIUMNVD
EPSS
0.1%
top 71.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedMar 3

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16.6 — 17.7.6+2
▶NVDgitlab/gitlab16.6.0 — 17.7.6+2
▶debiandebian/gitlab
▶gitlabgitlab/gitlab

🔴Vulnerability Details

1
GHSA
GHSA-g5qp-3jx2-p69r: An issue has been discovered in GitLab CE/EE affecting all versions from 16↗2025-03-03
▶

📋Vendor Advisories

2
GitLab
CVE-2024-8186: An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker c↗2025-03-03
▶
Debian
CVE-2024-8186: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 be...↗2024
▶