« Volver al listado

CVE-2017-8778

Estado: ModificadaMedia (6.1)—

GitLab anteriores a 8.14.9, 8.15.x anteriores a 8.15.6 y 8.16.x anteriores a 8.16.5 tienen XSS a través de un elemento SCRIPT en un archivo adjunto o un avatar que es un documento SVG.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Gitlab — Gitlab

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-8778",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-04T15:29:00.157",
  "references": [
    {
      "url": "https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/27471",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://about.gitlab.com/2017/02/15/gitlab-8-dot-16-dot-5-security-release/",
      "tags": [
        "Patch",
        "Release Notes",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://gitlab.com/gitlab-org/gitlab-ce/issues/27471",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GitLab before 8.14.9, 8.15.x before 8.15.6, and 8.16.x before 8.16.5 has XSS via a SCRIPT element in an issue attachment or avatar that is an SVG document."
    },
    {
      "lang": "es",
      "value": "GitLab anteriores a 8.14.9, 8.15.x anteriores a 8.15.6 y 8.16.x anteriores a 8.16.5 tienen XSS a través de un elemento SCRIPT en un archivo adjunto o un avatar que es un documento SVG."
    }
  ],
  "lastModified": "2026-06-17T01:26:56.687",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "889A91B5-A5DF-4D15-80DD-8BC66A9AF272",
              "versionEndIncluding": "8.14.9"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "50E67A7C-962E-49EE-8B4C-86D764770EDE"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8CE48CAF-F691-4409-96F9-CBB3903D251D"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C2B07763-013A-48EE-AFB7-3CBB3DFAD60C"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0BDE7E4A-12A3-46A6-AE35-075247CF1226"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1F3C2EAC-68C0-4444-A366-238A54A96484"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.15.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42C1AA52-622D-4867-AB95-C64DDC185454"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.16.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1965736-D73F-44DC-BA29-D992CCEA9657"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.16.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3E274B52-360B-4F06-B307-89C6D044E444"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.16.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "02F132ED-1CC0-4A58-988F-B61D69FEB99E"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.16.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F9663040-C06C-4C11-9384-6DE1DE64A8C6"
            },
            {
              "criteria": "cpe:2.3:a:gitlab:gitlab:8.16.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D20B405B-38EB-4F10-AAE3-700EBB5F5E02"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}