CVE-2024-8180: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Q: What is the severity of CVE-2024-8180?

CVE-2024-8180 is classified as a moderate severity vulnerability due to the potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2024-8180?

To fix CVE-2024-8180, upgrade GitLab to version 17.3.7, 17.4.4, or 17.5.2 or later.

Q: What versions of GitLab are affected by CVE-2024-8180?

CVE-2024-8180 affects all GitLab CE/EE versions from 17.3.0 before 17.3.7, 17.4.0 before 17.4.4, and 17.5.0 before 17.5.2.

Q: What type of vulnerability is CVE-2024-8180?

CVE-2024-8180 is an improper output encoding vulnerability that can lead to cross-site scripting (XSS) if content security policy (CSP) is not enabled.

Q: Is enabling CSP a solution for CVE-2024-8180?

Yes, enabling content security policy (CSP) can help mitigate the risks associated with CVE-2024-8180.

Published Nov 13, 2024

Updated

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.

Affected Software

7 affected componentsFixes available

GitLab GitLab>=17.3.0<17.3.7

GitLab GitLab>=17.4.0<17.4.4

GitLab GitLab>=17.5.0<17.5.2

GitLab GitLab>=17.3<17.3.7, >=17.4<17.4.4, >=17.5<17.5.2

17.3.717.4.417.5.2

Remediation

Information

Upgrade to versions 17.3.7, 17.4.4, 17.5.2 or above.

Event History

Nov 14, 2024

CVE Published

via MITRE·11:02 AM

Data Sourced

via MITRE·11:02 AM

RemedyDescriptionSeverityWeakness

Apr 22, 2026

Data Sourced

via GitLab·08:55 AM

DescriptionSeverityAffected Software

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-8180?