CVE-2018-9244

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-04-05 · updated 2026-06-17
Weakness: CWE-79

Description

GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

Affected products

GitLab: from 9.2 before 10.4.7; from 10.5.0 before 10.5.7; from 10.6.0 before 10.6.3 — fixed in 10.4.7, 10.5.7, 10.6.3

How to fix

Upgrade to a fixed version: GitLab 10.4.7, 10.5.7, 10.6.3. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/
https://gitlab.com/gitlab-org/gitlab-ce/issues/41838
https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/
https://gitlab.com/gitlab-org/gitlab-ce/issues/41838

Get alerted when CVE-2018-9244 or the next vulnerability affects your stack