Cross-Site Scripting Vulnerability in GitLab Community Edition
CVE-2017-0923
6.1MEDIUM
Key Information:
- Vendor
Gitlab
- Vendor
- CVE Published:
- 21 March 2018
What is CVE-2017-0923?
A security vulnerability exists in GitLab Community Edition version 9.1 due to inadequate input validation within the IPython notebooks component. This flaw allows an attacker to exploit the application, resulting in persistent cross-site scripting (XSS). Successful exploitation can lead to unauthorized script execution, potentially compromising the integrity of user data and application functionality.
Affected Version(s)
GitLab Community and Enterprise Editions 9.1.0 - 10.1.5 Fixed in 10.1.6
GitLab Community and Enterprise Editions 10.2.0 - 10.2.5 Fixed in 10.2.6
GitLab Community and Enterprise Editions 10.3.0 - 10.3.3 Fixed in 10.3.4