CVE-2018-16050: XSS
Published Oct 3, 2018
·Updated
An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.5 and 11.2.x before 11.2.2. There is Persistent XSS in the Merge Request Changes View.
Affected Software
8 affected components
GitLab GitLab>=10.7.0<=10.7.7
GitLab GitLab>=10.7.0<=10.7.7
GitLab GitLab>=10.8.0<=10.8.6
GitLab GitLab>=10.8.0<=10.8.6
GitLab GitLab>=11.1.0<11.1.5
GitLab GitLab>=11.1.0<11.1.5
GitLab GitLab>=11.2.0<11.2.2
GitLab GitLab>=11.2.0<11.2.2
Event History
Oct 3, 2018
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-16050?
CVE-2018-16050 has a medium severity rating due to its persistent XSS vulnerability.
2
How do I fix CVE-2018-16050?
To fix CVE-2018-16050, upgrade GitLab to version 11.1.5 or 11.2.2 or later.
3
What versions of GitLab are affected by CVE-2018-16050?
CVE-2018-16050 affects GitLab Community and Enterprise Editions from versions 10.7.0 to 11.1.4 and 10.8.0 to 11.2.1.
4
What type of vulnerability is CVE-2018-16050?
CVE-2018-16050 is classified as a persistent cross-site scripting (XSS) vulnerability.
5
How can I mitigate the risk of CVE-2018-16050?
Mitigation of CVE-2018-16050 can be achieved by applying the available patches or upgrading to the latest version of GitLab.