Lucene search

Debian Security Bug TrackerDEBIANCVE:CVE-2024-4835

HistoryMay 23, 2024 - 7:15 a.m.

CVE-2024-4835

2024-05-2307:15:09

Debian Security Bug Tracker

security-tracker.debian.org

xss

gitlab

vulnerability

unix

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

A XSS condition exists within GitLab in versions 15.11 before 16.10.6, 16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition, an attacker can craft a malicious page to exfiltrate sensitive user information.

OSVersionArchitecturePackageVersionFilename
Debian999allgitlab<= 16.8.4-1gitlab_16.8.4-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	999	all	gitlab	<= 16.8.4-1	gitlab_16.8.4-1_all.deb

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

Related for DEBIANCVE:CVE-2024-4835