REDHAT-BUG-2428218: High severity GitLab GitLab CE/EE vulnerability
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.3, and 18.7 before 18.7.1 that could have allowed an unauthenticated user to execute arbitrary code in the context of an authenticated user's browser by convincing the legitimate user to visit a specially crafted webpage.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.6.3 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 18.7.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2428218?
The severity of REDHAT-BUG-2428218 is classified as high with a score of 7.
Which versions of GitLab are affected by REDHAT-BUG-2428218?
REDHAT-BUG-2428218 affects all versions of GitLab CE/EE from 18.6 before 18.6.3 and 18.7 before 18.7.1.
How do I fix REDHAT-BUG-2428218?
To fix REDHAT-BUG-2428218, upgrade GitLab to version 18.6.3 or 18.7.1 or later.
What type of vulnerability is REDHAT-BUG-2428218?
REDHAT-BUG-2428218 is an issue that could allow an unauthenticated user to execute arbitrary code in an authenticated user's browser.
What remediation has GitLab implemented for REDHAT-BUG-2428218?
GitLab has remediated the vulnerability by releasing fixed versions 18.6.3 and 18.7.1 to mitigate the issue.