CVE-2018-12605

2018-08-0318:29:00

Google

osv.dev

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

24.0%

JSON

An issue was discovered in GitLab Community Edition and Enterprise Edition 10.7.x before 10.7.6. The usage of ‘url_for’ contained a XSS issue due to it allowing arbitrary protocols as a parameter.

CPENameOperatorVersion
gitlabeq10.7.3-ee
gitlabeq10.7.0-ee
gitlabeq10.7.3
gitlabeq10.7.4
gitlabeq10.7.2-ee
gitlabeq10.7.5
gitlabeq10.7.2
gitlabeq10.7.1-ee
gitlabeq10.7.5-ee
gitlabeq10.7.1

Name	Operator	Version
gitlab	eq	10.7.3-ee
gitlab	eq	10.7.0-ee
gitlab	eq	10.7.3
gitlab	eq	10.7.4
gitlab	eq	10.7.2-ee
gitlab	eq	10.7.5
gitlab	eq	10.7.2
gitlab	eq	10.7.1-ee
gitlab	eq	10.7.5-ee
gitlab	eq	10.7.1