CVE-2019-10111: XSS
Published May 15, 2019
·Updated
An issue was discovered in GitLab Community and Enterprise Edition before 11.7.8, 11.8.x before 11.8.4, and 11.9.x before 11.9.2. It allows persistent XSS in the merge request "resolve conflicts" page.
Affected Software
6 affected components
GitLab GitLab<11.7.8
GitLab GitLab<11.7.8
GitLab GitLab>=11.8.0<11.8.4
GitLab GitLab>=11.8.0<11.8.4
GitLab GitLab>=11.9.0<11.9.2
GitLab GitLab>=11.9.0<11.9.2
Event History
May 15, 2019
CVE Published
via MITRE·07:28 PM
Data Sourced
via MITRE·07:28 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-10111?
CVE-2019-10111 is classified as a medium severity vulnerability.
2
How do I fix CVE-2019-10111?
To fix CVE-2019-10111, you should upgrade GitLab to version 11.7.8 or later for both Community and Enterprise Editions.
3
What types of attacks can CVE-2019-10111 enable?
CVE-2019-10111 enables persistent cross-site scripting (XSS) attacks on the merge request 'resolve conflicts' page.
4
Which GitLab versions are affected by CVE-2019-10111?
CVE-2019-10111 affects GitLab versions before 11.7.8, 11.8.4, and 11.9.2.
5
Who is affected by CVE-2019-10111?
Users of GitLab Community and Enterprise Editions are affected by CVE-2019-10111 if they are running the specified vulnerable versions.