CVE-2022-0427

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrar...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"14.5.0"},{"fixed":"14.5.4"},{"introduced":"14.6.0"},{"fixed":"14.6.4"},{"introduced":"14.7.0"},{"fixed":"14.7.1"}]}]

参照URL

advisory gitlab.com
advisory gitlab.com
advisory hackerone.com
web nvd.nist.gov