GitLab has announced the release of critical security updates for both its Community Edition (CE) and Enterprise Edition (EE) to address a significant HTML injection vulnerability identified as CVE-2024-8312. This vulnerability poses a serious risk as it could lead to cross-site scripting (XSS) attacks, affecting all GitLab CE/EE versions from 15.10 to the latest releases prior to the patches. The newly patched versions—17.5.1, 17.4.3, and 17.3.6—are now available for immediate upgrade, highlighting the importance of maintaining secure installations.
The vulnerability allows an attacker to inject HTML into the Global Search field on a diff view, which could be exploited for malicious purposes. With a CVSS score of 8.7, this issue is classified as high severity due to its potential impact on the confidentiality and integrity of user data. GitLab has emphasized the need for users to upgrade their self-managed installations without delay to mitigate the risks associated with this vulnerability. For GitLab.com users, the platform has already been updated, ensuring that they are protected from potential threats.
In addition to the XSS vulnerability, the recent updates also address a medium-severity denial of service (DoS) vulnerability identified as CVE-2024-6826. This flaw could allow attackers to disrupt services by importing a maliciously crafted XML file, affecting versions from 11.2 onward. Both vulnerabilities were responsibly reported by security researchers through GitLab’s HackerOne bug bounty program, demonstrating the company’s commitment to maintaining robust security measures.
GitLab continues to prioritize security by releasing both scheduled and ad-hoc critical patches for high-severity vulnerabilities. Scheduled releases occur twice monthly on the second and fourth Wednesdays. Users are encouraged to visit GitLab’s release blog and security FAQ for detailed information on maintaining secure installations. Additionally, best practices for securing GitLab instances are outlined in the company’s blog, ensuring that users are well-informed about the necessary steps to protect their data and systems effectively.
