CVE-2018-19570: XSS
GitLab CE/EE, versions 11.3 before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via unrecognized HTML tags.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.3.11 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.4.8 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 11.5.1
Event History
Frequently Asked Questions
What is the severity of CVE-2018-19570?
CVE-2018-19570 is classified as a medium severity XSS vulnerability.
How do I fix CVE-2018-19570?
To remediate CVE-2018-19570, upgrade to GitLab version 11.3.11, 11.4.8, or 11.5.1 or later.
What types of systems are affected by CVE-2018-19570?
CVE-2018-19570 affects GitLab Community and Enterprise Editions versions prior to 11.3.11, 11.4.8, and 11.5.1.
What is the nature of the vulnerability in CVE-2018-19570?
CVE-2018-19570 is an XSS vulnerability that occurs in Markdown fields through the use of unrecognized HTML tags.
Can CVE-2018-19570 be exploited remotely?
Yes, CVE-2018-19570 can be exploited remotely if an attacker can submit crafted Markdown content.