3 ms·
XSS vulnerability in GitLab prior to 6.5.0
- Ysx 13y agoCVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-7316 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...
- namarkiv 13y agoLooks like this is the fix: https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680db07397a44a0824355c703c8 https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...
- emillon 13y agoThat's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.