CVE-2018-19573

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

GitLab CE/EE, versions 10.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in Markdown fields via Mermaid.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/109164Broken Link, Third Party Advisory, VDB Entry
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/45906Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/109164Broken Link, Third Party Advisory, VDB Entry
https://about.gitlab.com/2018/11/28/security-release-gitlab-11-dot-5-dot-1-released/Broken Link, Release Notes, Vendor Advisory
https://gitlab.com/gitlab-org/gitlab-ce/issues/45906Issue Tracking, Vendor Advisory

Timeline

Published: Jul 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-195745.4GitLab CE/EE, versions 7.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an XSS vulnerability in CVE-2018-195754.3GitLab CE/EE, versions 10.1 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an insecure direct obje CVE-2018-195768.1GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue CVE-2018-195775.3Gitlab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an incorrect access cont CVE-2018-195786.5GitLab EE, version 11.5 before 11.5.1, is vulnerable to an insecure object reference issue that permits a user with Reporter privileges to v CVE-2018-195795.4GitLab EE version 11.5 is vulnerable to a persistent XSS vulnerability in the Operations page. This is fixed in 11.5.1.CVE-2018-195805.3All versions of GitLab prior to 11.5.1, 11.4.8, and 11.3.11 do not send an email to the old email address when an email address change is ma CVE-2018-195817.5GitLab EE, versions 8.3 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure object reference CVE-2018-195824.3GitLab EE, versions 11.4 before 11.4.8 and 11.5 before 11.5.1, is affected by an insecure direct object reference vulnerability that permits CVE-2018-195836.5GitLab CE/EE, versions 8.0 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, would log access tokens in the Workhorse l CVE-2018-195847.5GitLab EE, versions 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, is vulnerable to an insecure direct object reference vu CVE-2018-195857.5GitLab CE/EE versions 8.18 up to 11.x before 11.3.11, 11.4.x before 11.4.8, and 11.5.x before 11.5.1 have CRLF Injection in Project Mirrorin