XSS vulnerability in GitLab prior to 6.5.0(blog.gitlab.org)

27 pointsby alsutton010203vor 12 Jahren3 comments

blog.gitlab.org

XSS vulnerability in GitLab prior to 6.5.0

http://blog.gitlab.org/xss-vulnerability-in-gitlab/

3 comments

namarkivvor 12 Jahren

Looks like this is the fix: https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...

Ysxvor 12 Jahren

CVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...

emillonvor 12 Jahren

That's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.