CVE-2024-7047CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

High · published July 25, 2024

CVSS v3.1
7.7
EPSS
0%
Percentile
26.7
In the wild
Unconfirmed
What it is

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.

The record
Technical detail
CVSS v3.1
7.7 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00344 · 26.7th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-07-25T00:30Z
EPSS history
Timeline
  • 25 JUL 00:30Z
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
    cvelistv5