CVE-2024-10383CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork

High · published February 7, 2025

CVSS v3.1
8.7
EPSS
0%
Percentile
19.9
In the wild
Unconfirmed
What it is

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

The record
Technical detail
CVSS v3.1
8.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00285 · 19.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2025-02-07T14:12Z
EPSS history
Timeline
  • 07 FEB 14:12Z
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab VSCode Fork
    cvelistv5