Vulnerability Description
An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.
CVSS Score
5.4
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gitlab | Gitlab | >= 17.3.0, < 17.3.7 |
Related Weaknesses (CWE)
References
- https://about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-releaseVendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/480720Broken Link
- https://hackerone.com/reports/2654010Permissions Required
FAQ
What is CVE-2024-8180?
CVE-2024-8180 is a vulnerability with a CVSS score of 5.4 (MEDIUM). An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enable...
How severe is CVE-2024-8180?
CVE-2024-8180 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2024-8180?
Check the references section above for vendor advisories and patch information. Affected products include: Gitlab Gitlab.