CVE-2018-18643

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

GitLab CE & EE 11.2 and later and before 11.5.0-rc12, 11.4.6, and 11.3.10 have Persistent XSS.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/53385Patch, Vendor Advisory
https://about.gitlab.com/2018/11/19/critical-security-release-gitlab-11-dot-4-dot-6-released/Vendor Advisory
https://about.gitlab.com/blog/categories/releases/Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/53385Patch, Vendor Advisory

Timeline

Published: Apr 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-186446.5An issue was discovered in GitLab Community and Enterprise Edition 11.x before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It al CVE-2018-186454.3An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows CVE-2018-186468.8An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It allows CVE-2018-186476.5An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Mis CVE-2018-186487.5An issue was discovered in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11.4.3. It has Inf CVE-2018-186499.8An issue was discovered in the wiki API in GitLab Community and Enterprise Edition before 11.2.7, 11.3.x before 11.3.8, and 11.4.x before 11 CVE-2018-186505.5An issue was discovered in Xpdf 4.00. XRef::readXRefStream in XRef.cc allows attackers to launch a denial of service (Integer Overflow) via CVE-2018-186515.5An issue was discovered in Xpdf 4.00. catalog->getNumPages() in AcroForm.cc allows attackers to launch a denial of service (hang caused by l CVE-2018-186527.2A remote command execution vulnerability in Veritas NetBackup Appliance before 3.1.2 allows authenticated administrators to execute arbitrar CVE-2018-186537.8The Linux kernel, as used in Ubuntu 18.10 and when booted with UEFI Secure Boot enabled, allows privileged local users to bypass intended Se CVE-2018-186547.8Crossroads 2.81 does not properly handle the /tmp directory during a build of xr. A local attacker can first create a world-writable subdire CVE-2018-186554.3Prayer through 1.3.5 sends a Referer header, containing a user's username, when a user clicks on a link in their email because header.t lack