description: A XSS vulnerability exists in Gitlab CE/EE from 12.4 before 13.4.7, 13.5 before 13.5.5, and 13.6 before 13.6.2 that allows an attacker to perform cross-site scripting to other users via importing a malicious project
problem types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab
affected:
{
product: Gitlab CE/EE
vendor: GitLab
versions:
status: affected, version: >=12.4
status: affected, version: <13.4.7
status: affected, version: >=13.5
status: affected, version: <13.5.5
status: affected, version: >=13.6
status: affected, version: <13.6.2
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:L
version: 3.1
]