Lucene search

[email protected]CVE-2018-17537

HistoryApr 16, 2023 - 12:15 a.m.

CVE-2018-17537

2023-04-1600:15:07

CWE-79

[email protected]

web.nvd.nist.gov

235

cve-2018-17537

gitlab

xss

stored xss

security vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.9 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.2%

JSON

An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. blog-viewer has stored XSS during repository browsing, if package.json exists. .

Affected configurations

NVD

Node

gitlabgitlabRange<11.1.7community

gitlabgitlabRange<11.1.7enterprise

gitlabgitlabRange11.2.0–11.2.4community

gitlabgitlabRange11.2.0–11.2.4enterprise

gitlabgitlabMatch11.3.0community

gitlabgitlabMatch11.3.0enterprise

CPENameOperatorVersion
gitlab:gitlabgitlablt11.1.7
gitlab:gitlabgitlablt11.2.4
gitlab:gitlabgitlabeq11.3.0

CPE	Name	Operator	Version
gitlab:gitlab	gitlab	lt	11.1.7
gitlab:gitlab	gitlab	lt	11.2.4
gitlab:gitlab	gitlab	eq	11.3.0

References

about.gitlab.com/blog/categories/releases/

about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released/

Social References