CVE-2024-10383

Published: Feb 7, 2025Modified: Aug 14, 2025

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: NVD

Description

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

Affected (8)

Products: Gitlab: Gitlab

Gitlab

1 product

Gitlab

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Gitlab Gitlab	From 15.11.0 to 17.3.0
Gitlab Gitlab	From 15.11.0 to 17.3.0
Gitlab Gitlab	Version 17.4.0
Gitlab Gitlab	Version 17.4.0
Gitlab Gitlab	Version 17.5.0
Gitlab Gitlab	Version 17.5.0
Gitlab Gitlab	Version 17.6.0
Gitlab Gitlab	Version 17.6.0

Related CWEs

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (3)

https://gitlab.com/gitlab-org/gitlab/-/issues/500785

Source: cve@gitlab.com

Broken Link

https://hackerone.com/reports/2765778

Source: cve@gitlab.com

Permissions Required

https://gitlab.com/gitlab-org/gitlab/-/issues/500785

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Broken Link

Timeline

No history available yet.