CVE-2018-10379

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-31 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before 10.7.2. The Move Issue feature contained a persistent XSS vulnerability.

Affected products

GitLab: before 10.5.8; from 10.6.0 before 10.6.5; from 10.7.0 before 10.7.2 — fixed in 10.5.8, 10.6.5, 10.7.2

How to fix

Upgrade to a fixed version: GitLab 10.5.8, 10.6.5, 10.7.2. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/104491
https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released/
http://www.securityfocus.com/bid/104491
https://about.gitlab.com/2018/04/30/security-release-gitlab-10-dot-7-dot-2-released/

Get alerted when CVE-2018-10379 or the next vulnerability affects your stack