Lucene search

MitreCVE-2018-9243

HistoryApr 05, 2018 - 2:29 p.m.

CVE-2018-9243

2018-04-0514:29:00

CWE-79

mitre

web.nvd.nist.gov

cve-2018-9243

gitlab

xss

input validation

merge request

security vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.8%

JSON

GitLab Community and Enterprise Editions version 8.4 up to 10.4 are vulnerable to XSS because a lack of input validation in the merge request component leads to cross site scripting (specifically, filenames in changes tabs of merge requests). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

Affected configurations

Nvd

Node

gitlabgitlabRange8.4–10.4.7community

gitlabgitlabRange8.4–10.4.7enterprise

gitlabgitlabRange10.5.0–10.5.7community

gitlabgitlabRange10.5.0–10.5.7enterprise

gitlabgitlabRange10.6.0–10.6.3community

gitlabgitlabRange10.6.0–10.6.3enterprise

References

about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/

gitlab.com/gitlab-org/gitlab-ce/issues/42028

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

39.8%

JSON

Related for CVE-2018-9243