Improper Neutralization of Input During Web Page Generation…(CVE-2024-7047)

概要

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

影響パッケージ

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"16.6.0"},{"fixed":"17.0.5"},{"introduced":"17.1.0"},{"fixed":"17.1.3"},{"introduced":"17.2.0"},{"fixed":"17.2.1"}]}]

参照URL

web gitlab.com
web nvd.nist.gov