CVE-2024-10383

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10383
An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

8.7 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://gitlab.com/gitlab-org/gitlab/-/issues/500785 Broken Link
https://hackerone.com/reports/2765778 Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/500785 Broken Link
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:enterprise:*:*:*
History

14 Aug 2025, 19:24

Type Values Removed Values Added
First Time Gitlab gitlab
Gitlab
References () https://gitlab.com/gitlab-org/gitlab/-/issues/500785 - () https://gitlab.com/gitlab-org/gitlab/-/issues/500785 - Broken Link
References () https://hackerone.com/reports/2765778 - () https://hackerone.com/reports/2765778 - Permissions Required
Summary
  • (es) Se ha descubierto un problema en el componente gitlab-web-ide-vscode-fork distribuido a través de CDN que afecta a todas las versiones anteriores a 1.89.1-1.0.0-dev-20241118094343 y utilizado por todas las versiones de GitLab CE/EE a partir de 15.11 antes de 17.3 y que también afectó temporalmente a las versiones 17.4, 17.5 y 17.6, donde era posible un ataque XSS al cargar archivos .ipynb en el IDE web.
CPE cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:community:*:*:*
cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*
cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*

07 Feb 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-07 15:15

Updated : 2025-08-14 19:24

NVD link : CVE-2024-10383

Mitre link : CVE-2024-10383

CVE.ORG link : CVE-2024-10383

JSON object : View

Products Affected

gitlab

  • gitlab
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')