VDB
CVE-2024-4201
CVE-2024-4201
PUBLISHED
A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 16.10.7, all versions starting from 16.11 before 16.111.4, all versions starting from 17.0 before 17.0.2. When viewing an XML file in a repository in raw mode, it can be made to render as HTML if viewed under specific circumstances.
EPSS 1.13% · 78.7th percentile
Risk Scores
EPSS Score
1.13%
78.7th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Bitnami | gitlab | 5.1.0, 16.11.0, 17.0.0 |
| Bitnami | gitlab | 5.1.0, 16.11.0, 17.0.0 |
Timeline
- Jan 21, 1970 Security Advisory
- Jun 12, 2024 CVE Published
- Jun 13, 2024 EPSS Score
- Jul 6, 2024 EPSS Score
- Jul 29, 2024 EPSS Score
- Aug 21, 2024 EPSS Score
- Sep 13, 2024 EPSS Score
- Oct 4, 2024 Coalition ESS Score
- Oct 29, 2024 EPSS Score
- Nov 21, 2024 EPSS Score
- Dec 14, 2024 EPSS Score
- Jan 6, 2025 EPSS Score
References
- https://about.gitlab.com/releases/2024/06/12/patch-release-gitlab-17-0-2-released/#xss-and-content-injection-when-viewing-raw-xhtml-files-on-ios-devices url
- https://gitlab.com/gitlab-org/gitlab/-/issues/458229 url
- https://hackerone.com/reports/2473886 url
- https://nvd.nist.gov/vuln/detail/CVE-2024-4201 url