CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionNVD
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to add unauthorized email addresses to victim accounts through HTML injection in test case titles.
AnalysisAI
Authenticated users in GitLab CE/EE versions 13.9 through 18.8.3 can inject HTML into test case titles to add unauthorized email addresses to victim accounts. This stored XSS vulnerability requires user interaction and does not impact confidentiality of the attacker's own data. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Inventory all GitLab instances and identify affected versions (13.9-18.6.5, 18.7.0-18.7.3, 18.8.0-18.8.3). Within 7 days: Prioritize patching to 18.6.6, 18.7.4, or 18.8.4+; if patching is not immediately feasible, restrict test case creation permissions to trusted users only and audit recent test case modifications for suspicious HTML injection patterns. …
Sign in for detailed remediation steps.
More from same product – last 7 days
Command injection in Prefect 3.6.18's GitHub integration allows authenticated users to execute arbitrary git commands th
Incorrect authorization enforcement in GitLab CE/EE permits a blocked Project Access Token to continue reading private p
Identity confusion in GitLab EE's Duo AI workflow runners lets an authenticated, low-privileged user cause specific Duo
Denial of service in GitLab CE/EE affects all versions from 17.1 through those prior to 18.10.7, 18.11.4, and 19.0.1, al
Unauthorized private project enumeration in GitLab CE/EE exposes confidential project metadata to unauthenticated networ
Share
External POC / Exploit Code
Leaving vuln.today