CVE-2017-0917

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the CI job component resulting in persistent cross site scripting.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-20

Affected software

Vendor	Product	Versions
GitLab	GitLab Community and Enterprise Editions	9.1.0 - 10.1.5 Fixed in 10.1.6; 10.2.0 - 10.2.5 Fixed in 10.2.6; 10.3.0 - 10.3.3 Fixed in 10.3.4

References

https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://hackerone.com/reports/299525Permissions Required
https://www.debian.org/security/2018/dsa-4145Third Party Advisory
https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released/Vendor Advisory
https://hackerone.com/reports/299525Permissions Required
https://www.debian.org/security/2018/dsa-4145Third Party Advisory

Timeline

Published: Mar 21, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-09188.8Gitlab Community Edition version 10.3 is vulnerable to a path traversal issue in the GitLab CI runner component resulting in remote code exe CVE-2017-09197.5GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the GitLab imp CVE-2017-09204.3GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an authorization bypass issue in the Projects::CVE-2017-09218.1GitLab Community and Enterprise Editions before 10.1.6, 10.2.6, and 10.3.4 are vulnerable to an unverified password change issue in the Pass CVE-2017-09227.5Gitlab Enterprise Edition version 10.3 is vulnerable to an authorization bypass issue in the GitLab Projects::BoardsController component res CVE-2017-09236.1Gitlab Community Edition version 9.1 is vulnerable to lack of input validation in the IPython notebooks component resulting in persistent cr CVE-2017-09246.1Gitlab Community Edition version 10.2.4 is vulnerable to lack of input validation in the labels component resulting in persistent cross site CVE-2017-09257.2Gitlab Enterprise Edition version 10.1.0 is vulnerable to an insufficiently protected credential issue in the project service integration AP CVE-2017-09268.8Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the Oauth sign-in component resulting in unauthori CVE-2017-09276.5Gitlab Community Edition version 10.3 is vulnerable to an improper authorization issue in the deployment keys component resulting in unautho CVE-2017-09286.1html-janitor node module suffers from an External Control of Critical State Data vulnerability via user-control of the '_sanitized' variable CVE-2017-09297.5DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class. Attackers ma