Cross-site scripting in Gitlab Community Edition - CVE-2018-19574
Published: July 10, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU31003
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2018-19574
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to read and manipulate data.
GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in the OAuth authorization page.
Affected software
Gitlab Community Edition
How to mitigate CVE-2018-19574
Install update from vendor's website.
Gitlab Community Edition - update to 11.5.1