Ubuntu.comUB:CVE-2024-4201CVE-2024-4201
4.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%
A cross-site scripting issue has been discovered in GitLab affecting all
versions starting from 5.1 before 16.10.7, all versions starting from 16.11
before 16.111.4, all versions starting from 17.0 before 17.0.2. When
viewing an XML file in a repository in raw mode, it can be made to render
as HTML if viewed under specific circumstances.
References
about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices
gitlab.com/gitlab-org/gitlab/-/issues/458229
hackerone.com/reports/2473886
launchpad.net/bugs/cve/CVE-2024-4201
nvd.nist.gov/vuln/detail/CVE-2024-4201
security-tracker.debian.org/tracker/CVE-2024-4201
www.cve.org/CVERecord?id=CVE-2024-4201
Related
4.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
6.2 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
15.5%