JavaScript Injection Vulnerability in GitLab CE/EE
CVE-2024-8648

6.1MEDIUM

Key Information:

Vendor

Gitlab
Status
Gitlab
Vendor
CVE Published:
14 November 2024

What is CVE-2024-8648?

A vulnerability has been identified in GitLab CE/EE that affects various versions, specifically those from 16 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. This issue permits an attacker to execute a JavaScript injection through specially crafted URLs targeting the Analytics Dashboards. If exploited, this could allow for unauthorized actions or data manipulation within the affected dashboards, compromising the integrity and security of user data.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://gitlab.com/gitlab-org/gitlab/-/issues/486220
https://hackerone.com/reports/2683863
https://about.gitlab.com/releases/2024/11/13/patch-releas...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

JSON
.