{"id":"CVE-2024-7047","state":"PUBLISHED","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","description":"A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user.","publishedAt":"2024-07-25T00:30:40.657Z","updatedAt":"2024-08-29T15:05:00.689Z","severity":{"score":7.7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.6","status":"affected","lessThan":"17.0.5","versionType":"semver"},{"version":"17.1","status":"affected","lessThan":"17.1.3","versionType":"semver"},{"version":"17.2","status":"affected","lessThan":"17.2.1","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git"}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/455318"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/7xxx/CVE-2024-7047.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-7047","state":"PUBLISHED","datePublished":"2024-07-25T00:30:40.657Z","dateUpdated":"2024-08-29T15:05:00.689Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2024-07-23T19:02:09.094Z"},"containers":{"cna":{"title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","descriptions":[{"lang":"en","value":"A cross site scripting vulnerability exists in GitLab CE/EE affecting all versions from 16.6 prior to 17.0.5, 17.1 prior to 17.1.3, 17.2 prior to 17.2.1 allowing an attacker to execute arbitrary scripts under the context of the current logged in user."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.6","status":"affected","lessThan":"17.0.5","versionType":"semver"},{"version":"17.1","status":"affected","lessThan":"17.1.3","versionType":"semver"},{"version":"17.2","status":"affected","lessThan":"17.2.1","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git"}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/455318","name":"GitLab Issue #455318","tags":["issue-tracking","permissions-required"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.7,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2024-08-29T15:05:00.689Z"},"credits":[{"lang":"en","type":"finder","value":"This vulnerability has been discovered internally by GitLab team member [Joern Schneeweisz](https://gitlab.com/joernchen)."}],"solutions":[{"lang":"en","value":"Upgrade to versions 17.0.5, 17.1.3, 17.2.1 or above."}]},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"gitlab","product":"gitlab","defaultStatus":"unknown","versions":[{"version":"16.6","status":"affected","lessThan":"17.0.5","versionType":"semver"},{"version":"17.1","status":"affected","lessThan":"17.1.3","versionType":"semver"},{"version":"17.2","status":"affected","lessThan":"17.2.1","versionType":"semver"}],"cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-07-26T19:21:10.790408Z","id":"CVE-2024-7047","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-07-26T19:21:17.148Z"}},{"title":"CVE Program Container","references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/455318","name":"GitLab Issue #455318","tags":["issue-tracking","permissions-required","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T21:45:38.425Z"}}]}}}