CVE-2024-6530CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

High · published October 10, 2024

CVSS v3.1
7.3
EPSS
2%
Percentile
82.1
In the wild
Unconfirmed
What it is

A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 17.1 prior 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2. When adding a authorizing an application, it can be made to render as HTML under specific circumstances.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.02171 · 82.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-10-10T12:02Z
EPSS history
Timeline
  • 10 OCT 12:02Z
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
    cvelistv5