CVE-2017-8778 Information

Description

GitLab before 8.14.9 8.15.x before 8.15.6 and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Reference

https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/ https://gitlab.com/gitlab-org/gitlab-ce/issues/27471

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

CHANGED

Integrity Impact

LOW

Availability Impact

LOW

Base Score

NONE

Base Severity

6.1