Lucene search

[email protected]CVE-2017-8778

HistoryMay 04, 2017 - 3:29 p.m.

CVE-2017-8778

2017-05-0415:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2017-8778

gitlab

xss vulnerability

security

nvd

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

45.1%

JSON

GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.

Affected configurations

NVD

Node

gitlabgitlabRange≤8.14.9

gitlabgitlabMatch8.15.0

gitlabgitlabMatch8.15.1

gitlabgitlabMatch8.15.2

gitlabgitlabMatch8.15.3

gitlabgitlabMatch8.15.4

gitlabgitlabMatch8.15.5

gitlabgitlabMatch8.16.0

gitlabgitlabMatch8.16.1

gitlabgitlabMatch8.16.2

gitlabgitlabMatch8.16.3

gitlabgitlabMatch8.16.4

CPENameOperatorVersion
gitlab:gitlabgitlable8.14.9
gitlab:gitlabgitlabeq8.15.0
gitlab:gitlabgitlabeq8.15.1
gitlab:gitlabgitlabeq8.15.2
gitlab:gitlabgitlabeq8.15.3
gitlab:gitlabgitlabeq8.15.4
gitlab:gitlabgitlabeq8.15.5
gitlab:gitlabgitlabeq8.16.0
gitlab:gitlabgitlabeq8.16.1
gitlab:gitlabgitlabeq8.16.2

CPE	Name	Operator	Version
gitlab:gitlab	gitlab	le	8.14.9
gitlab:gitlab	gitlab	eq	8.15.0
gitlab:gitlab	gitlab	eq	8.15.1
gitlab:gitlab	gitlab	eq	8.15.2
gitlab:gitlab	gitlab	eq	8.15.3
gitlab:gitlab	gitlab	eq	8.15.4
gitlab:gitlab	gitlab	eq	8.15.5
gitlab:gitlab	gitlab	eq	8.16.0
gitlab:gitlab	gitlab	eq	8.16.1
gitlab:gitlab	gitlab	eq	8.16.2

Rows per page:

1-10 of 121

References

about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/

gitlab.com/gitlab-org/gitlab-ce/issues/27471

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

0.001 Low

EPSS

Percentile

45.1%

JSON

Related for CVE-2017-8778

debiancve1 prion1 nvd1 ubuntucve1 openvas1 cvelist1