Lucene search

K
ubuntucveUbuntu.comUB:CVE-2024-4835
HistoryMay 23, 2024 - 12:00 a.m.

CVE-2024-4835

2024-05-2300:00:00
ubuntu.com
ubuntu.com
26
xss
gitlab
vulnerability
information exfiltration
unix

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

A XSS condition exists within GitLab in versions 15.11 before 16.10.6,
16.11 before 16.11.3, and 17.0 before 17.0.1. By leveraging this condition,
an attacker can craft a malicious page to exfiltrate sensitive user
information.

OSVersionArchitecturePackageVersionFilename
ubuntu16.04noarchgitlab< anyUNKNOWN

8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

6.1 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%