GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
BID:67538
Info
GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
| Bugtraq ID: | 67538 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-3456 |
| Remote: | Yes |
| Local: | No |
| Published: | Feb 27 2014 12:00AM |
| Updated: | Mar 19 2015 09:16AM |
| Credit: | The vendor reported this issue. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
GitLab Enterprise Edition is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.
GitLab Enterprise Edition prior to 6.6.2 are vulnerable.
GitLab Enterprise Edition is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user.
GitLab Enterprise Edition prior to 6.6.2 are vulnerable.
Exploit / POC
GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
An attacker can exploit this issue through a browser.
An attacker can exploit this issue through a browser.
Solution / Fix
GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
GitLab Enterprise Edition CVE-2014-3456 Unspecified HTML Injection Vulnerability
References:
References: