CVE-2024-8648 — Cross-site Scripting in Gitlab

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
6.1MEDIUMNVD
EPSS
3.1%
top 13.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
GitlabDebian GitlabGitlab CE
Timeline
PublishedNov 14

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerability could allow an attacker to inject malicious JavaScript code in Analytics Dashboards through a specially crafted URL.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages5 packages

▶CVEListV5gitlab/gitlab16 — 17.3.7+2
▶NVDgitlab/gitlab16.0.0 — 17.3.7+2
▶debiandebian/gitlab< gitlab 17.5.5-1 (sid)
▶gitlabgitlab/gitlab

🔴Vulnerability Details

2
GHSA
GHSA-p27q-qvwx-7mg5: An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17↗2024-11-14
▶
OSV
CVE-2024-8648: An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17↗2024-11-14
▶

📋Vendor Advisories

2
GitLab
CVE-2024-8648: An issue has been discovered in GitLab CE/EE affecting all versions from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. The vulnerabili↗2024-11-14
▶
Debian
CVE-2024-8648: gitlab - An issue has been discovered in GitLab CE/EE affecting all versions from 16 befo...↗2024
▶