Cross site scripting

2020-10-0814:15:00

PRIOn knowledge base

www.prio-n.com

8 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.4%

JSON

An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log

CPENameOperatorVersion
gitlabge13.4.0
gitlablt13.4.2
gitlabge13.4.0
gitlablt13.4.2
gitlabge13.3.0
gitlablt13.3.7
gitlabge13.3.0
gitlablt13.3.7
gitlablt13.2.10
gitlablt13.2.10

Name	Operator	Version
gitlab	ge	13.4.0
gitlab	lt	13.4.2
gitlab	ge	13.4.0
gitlab	lt	13.4.2
gitlab	ge	13.3.0
gitlab	lt	13.3.7
gitlab	ge	13.3.0
gitlab	lt	13.3.7
gitlab	lt	13.2.10
gitlab	lt	13.2.10

References

gitlab.com/gitlab-org/cves/-/blob/master/2020/CVE-2020-13340.json

gitlab.com/gitlab-org/gitlab/-/issues/233473

hackerone.com/reports/950190