CVE-2024-8180

MEDIUM 5.4CVE-2024-8180 · Published 14/11/2024 · updated 17/06/2026

In short

CVE-2024-8180 is a MEDIUM (CVSS 5.4) vulnerability affecting gitlab (gitlab).
Chance of exploitation in the next 30 days (EPSS): 0.38%, higher than 32.2% of all vulnerabilities.
Fix: update to 17.3.7, 17.4.4, 17.5.2 or later.

Package	Affected versions	Patched versions
gitlab gitlab	`≥ 17.3.0, < 17.3.7≥ 17.4.0, < 17.4.4≥ 17.5.0, < 17.5.2`	`17.3.717.4.417.5.2`

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 17.3 before 17.3.7, 17.4 before 17.4.4, and 17.5 before 17.5.2. Improper output encoding could lead to XSS if CSP is not enabled.

References

about.gitlab.com/releases/2024/11/13/patch-release-gitlab-17-5-2-released · Vendor Advisory
gitlab.com/gitlab-org/gitlab/-/issues/480720 · Broken Link
hackerone.com/reports/2654010 · Permissions Required

More vulnerabilities in gitlab

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

gitlab

≥ 17.3.0, < 17.3.7≥ 17.4.0, < 17.4.4≥ 17.5.0, < 17.5.2

17.3.717.4.417.5.2

More vulnerabilities in gitlab

See all →