CVE-2024-1451 — HIGH (8.7) — White Hats Nepal

Vulnerability Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."

CVSS Score

8.7

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Gitlab	Gitlab	16.9.0

Related Weaknesses (CWE)

CWE-79

References

https://gitlab.com/gitlab-org/gitlab/-/issues/441457Permissions Required
https://hackerone.com/reports/2371126Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/441457Permissions Required
https://hackerone.com/reports/2371126Permissions Required

FAQ

What is CVE-2024-1451?

CVE-2024-1451 is a vulnerability with a CVSS score of 8.7 (HIGH). An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.1. A crafted payload added to the user profile page could lead to a stored XSS on the client side, a...

How severe is CVE-2024-1451?

CVE-2024-1451 has been rated HIGH with a CVSS base score of 8.7/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-1451?

Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.