CVE-2024-7047: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.0.5 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.1.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 17.2.1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7047?
CVE-2024-7047 is classified as a cross-site scripting vulnerability that can significantly impact user security in GitLab.
How do I fix CVE-2024-7047?
To fix CVE-2024-7047, upgrade your GitLab installation to versions 17.0.5, 17.1.3, or 17.2.1 or later.
What versions of GitLab are affected by CVE-2024-7047?
CVE-2024-7047 affects GitLab CE/EE versions 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1.
Can CVE-2024-7047 be exploited remotely?
Yes, CVE-2024-7047 can be exploited remotely by an attacker targeting the current logged-in user's session.
What types of attacks can occur due to CVE-2024-7047?
Attackers can execute arbitrary scripts in the context of the logged-in user, which may lead to data theft or unauthorized actions.