CVE-2024-3092

{"id": "CVE-2024-3092", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cve@gitlab.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 2.3}]}, "published": "2024-04-12T01:15:57.937", "references": [{"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/452510", "source": "cve@gitlab.com"}, {"url": "https://hackerone.com/reports/2441257", "source": "cve@gitlab.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cve@gitlab.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. A payload may lead to a Stored XSS while using the diff viewer, allowing attackers to perform arbitrary actions on behalf of victims."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en GitLab CE/EE que afecta a todas las versiones desde 16.9 anteriores a 16.9.4, todas las versiones desde 16.10 anteriores a 16.10.2. Una carga \u00fatil puede generar un XSS almacenado mientras se usa el visor de diferencias, lo que permite a los atacantes realizar acciones arbitrarias en nombre de las v\u00edctimas."}], "lastModified": "2024-04-12T12:43:57.400", "sourceIdentifier": "cve@gitlab.com"}