UpHeron
All vulnerabilities

Servers and applications

CVE-2018-9244

GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.

Severity
Medium 6.1
Published
5 Apr 2018
Last changed
17 Jun 2026
Added to UpHeron
21 Oct 2026
Fixed in
10.4.7, 10.5.7, 10.6.3
Sources
NVD

Affected software

SoftwareAffected versions
GitLabServers and applications · cpe:a:gitlab:gitlab
  • From 9.2 before 10.4.7
  • From 10.5.0 before 10.5.7
  • From 10.6.0 before 10.6.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-9244
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-9244