CVE-2024-8186 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

CVE-2024-8186

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab PUBLISHED

Description (CNA)

An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.

Affected (CNA)

Vendor / product	Versions
GitLab / GitLab	affected 16.6 before 17.7.6; affected 17.8 before 17.8.4; affected 17.9 before 17.9.1

CWE

CWE-79

References

https://gitlab.com/gitlab-org/gitlab/-/issues/480751
https://hackerone.com/reports/2655757

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.