CVE-2024-3092: Stored XSS injected in diff viewer
An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims.
Affected Software
Remediation
Information
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2024-3092?
CVE-2024-3092 is considered a medium severity vulnerability due to its potential for stored cross-site scripting.
How does CVE-2024-3092 affect users of GitLab?
CVE-2024-3092 allows attackers to execute arbitrary actions on behalf of victims through the diff viewer.
Which versions of GitLab are impacted by CVE-2024-3092?
CVE-2024-3092 affects GitLab CE/EE versions starting from 16.9 before 16.9.4 and 16.10 before 16.10.2.
How do I fix CVE-2024-3092?
To fix CVE-2024-3092, upgrade your GitLab to versions 16.9.4 or 16.10.2 or later.
Are there any known exploits for CVE-2024-3092?
Yes, CVE-2024-3092 has known exploitation vectors due to its nature of allowing stored XSS attacks.