{"id":"CVE-2024-8186","state":"PUBLISHED","title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","description":"An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations.","publishedAt":"2025-03-03T10:02:44.912Z","updatedAt":"2025-03-03T12:32:03.051Z","severity":{"score":5.4,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","source":"GitLab"},"assigner":"GitLab","products":["GitLab GitLab"],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.6","status":"affected","lessThan":"17.7.6","versionType":"semver"},{"version":"17.8","status":"affected","lessThan":"17.8.4","versionType":"semver"},{"version":"17.9","status":"affected","lessThan":"17.9.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":["https://gitlab.com/gitlab-org/gitlab/-/issues/480751","https://hackerone.com/reports/2655757"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:08:20.985Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/8xxx/CVE-2024-8186.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-8186","state":"PUBLISHED","datePublished":"2025-03-03T10:02:44.912Z","dateUpdated":"2025-03-03T12:32:03.051Z","assignerShortName":"GitLab","assignerOrgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateReserved":"2024-08-26T18:30:35.192Z"},"containers":{"cna":{"title":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab","descriptions":[{"lang":"en","value":"An issue has been discovered in GitLab CE/EE affecting all versions from 16.6 before 17.7.6, 17.8 before 17.8.4, and 17.9 before 17.9.1. An attacker could inject HMTL into the child item search potentially leading to XSS in certain situations."}],"affected":[{"vendor":"GitLab","product":"GitLab","defaultStatus":"unaffected","versions":[{"version":"16.6","status":"affected","lessThan":"17.7.6","versionType":"semver"},{"version":"17.8","status":"affected","lessThan":"17.8.4","versionType":"semver"},{"version":"17.9","status":"affected","lessThan":"17.9.1","versionType":"semver"}],"repo":"git://git@gitlab.com:gitlab-org/gitlab.git","cpes":["cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*"]}],"references":[{"url":"https://gitlab.com/gitlab-org/gitlab/-/issues/480751","name":"GitLab Issue #480751","tags":["issue-tracking","permissions-required"]},{"url":"https://hackerone.com/reports/2655757","name":"HackerOne Bug Bounty Report #2655757","tags":["technical-description","exploit","permissions-required"]}],"metrics":[{"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}],"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":5.4,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","lang":"en","description":"CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","type":"CWE"}]}],"providerMetadata":{"shortName":"GitLab","orgId":"ceab7361-8a18-47b1-92ba-4d7d25f6715a","dateUpdated":"2025-03-03T10:02:44.912Z"},"solutions":[{"lang":"en","value":"Upgrade to versions 17.7.6, 17.8.4, 17.9.1  or above."}],"credits":[{"lang":"en","value":"Thanks [joaxcar](https://hackerone.com/joaxcar) for reporting this vulnerability through our HackerOne bug bounty program","type":"finder"}]},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-03-03T12:31:28.250221Z","id":"CVE-2024-8186","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-03-03T12:32:03.051Z"}}]}}}