CVE-2024-7047: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
First published: Thu Jul 25 2024(Updated: )
A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.
Credit: cve@gitlab.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GitLab | >=16.6.0<17.0.5 | |
| GitLab | >=16.6.0<17.0.5 | |
| GitLab | >=17.1.0<17.1.3 | |
| GitLab | >=17.1.0<17.1.3 | |
| GitLab | =7.2.0 | |
| GitLab | =7.2.0 |
Remedy
Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-7047?
CVE-2024-7047 is classified as a cross-site scripting vulnerability that can significantly impact user security in GitLab.
How do I fix CVE-2024-7047?
To fix CVE-2024-7047, upgrade your GitLab installation to versions 17.0.5, 17.1.3, or 17.2.1 or later.
What versions of GitLab are affected by CVE-2024-7047?
CVE-2024-7047 affects GitLab CE/EE versions 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1.
Can CVE-2024-7047 be exploited remotely?
Yes, CVE-2024-7047 can be exploited remotely by an attacker targeting the current logged-in user's session.
What types of attacks can occur due to CVE-2024-7047?
Attackers can execute arbitrary scripts in the context of the logged-in user, which may lead to data theft or unauthorized actions.
- agent/title
- agent/remedy
- agent/references
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/description
- agent/author
- agent/event
- agent/severity
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/gitlab
- canonical/gitlab
- version/gitlab/16.6.0
- version/gitlab/17.1.0
- version/gitlab/7.2.0