CVE-2017-0923 - Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting

Back Back to CVE browser

MEDIUM

Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting

Published Mar 21, 2018

6.1

MEDIUM

CVSS 3.0

EPSS 0.76%

Description

Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cross site scripting.

Affected products

Vendor GitLab Product GitLab Community and Enterprise Editions Default
unknown
Affected
- 10.2.0 - 10.2.5 Fixed in 10.2.6
- 10.3.0 - 10.3.3 Fixed in 10.3.4
- 9.1.0 - 10.1.5 Fixed in 10.1.6

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
GitLab	GitLab Community and Enterprise Editions	unknown	Affected 10.2.0 - 10.2.5 Fixed in 10.2.6 10.3.0 - 10.3.3 Fixed in 10.3.4 9.1.0 - 10.1.5 Fixed in 10.1.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/
x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1266
Advisory
https://hackerone.com/reports/293740
x_refsource_MISCPermissions Required

Link	Providers	Tags
https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/		x_refsource_CONFIRMVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-1266		Advisory
https://hackerone.com/reports/293740		x_refsource_MISCPermissions Required

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner hackerone

Published Mar 21, 2018

Updated Aug 5, 2024

Reserved Nov 30, 2016

Link CVE-2017-0923

CISA Vulnrichment

No data

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-0923

Red Hat

No data

ENISA EUVD

Assigner hackerone

Published Mar 21, 2018

Updated Aug 5, 2024

Link EUVD-2017-1266

GitHub

No data