XSS vulnerability in GitLab prior to 6.5.0(blog.gitlab.org)

27 pointsby alsutton01020312 lat temu3 comments

blog.gitlab.org

XSS vulnerability in GitLab prior to 6.5.0

http://blog.gitlab.org/xss-vulnerability-in-gitlab/

3 comments

namarkiv12 lat temu

Looks like this is the fix: https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...

Ysx12 lat temu

CVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...

emillon12 lat temu

That's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.