CVE-2017-0917: Input Validation
Published Mar 21, 2018
·Updated
Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.
Affected Software
8 affected componentsFixes available
debian/gitlab
16.0.8+ds1-2
GitLab GitLab>=10.1.0<=10.1.5
GitLab GitLab>=10.1.0<=10.1.5
GitLab GitLab>=10.2.0<=10.2.5
GitLab GitLab>=10.2.0<=10.2.5
GitLab GitLab>=10.3.0<=10.3.3
GitLab GitLab>=10.3.0<=10.3.3
Debian Debian Linux=9.0
Event History
Mar 21, 2018
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2017-0917?
CVE-2017-0917 has a medium severity rating due to its potential for persistent cross-site scripting attacks.
2
How do I fix CVE-2017-0917?
To fix CVE-2017-0917, upgrade your GitLab installation to version 10.2.5 or later.
3
Which versions of GitLab are affected by CVE-2017-0917?
CVE-2017-0917 affects GitLab versions between 10.1.0 and 10.2.4.
4
Is CVE-2017-0917 specific to GitLab Community Edition?
CVE-2017-0917 affects both the GitLab Community and Enterprise editions.
5
What impact does CVE-2017-0917 have on users?
CVE-2017-0917 allows attackers to inject malicious scripts that can affect users who interact with the compromised CI job component.