VYPR
← All advisories
High severity8.7NVD Advisory· Published Feb 7, 2025· Updated Jun 17, 2026

CVE-2024-10383

CVE-2024-10383

Description

An issue has been discovered in the gitlab-web-ide-vscode-fork component distributed over CDN affecting all versions prior to 1.89.1-1.0.0-dev-20241118094343and used by all versions of GitLab CE/EE starting from 15.11 prior to 17.3 and which also temporarily affected versions 17.4, 17.5 and 17.6, where a XSS attack was possible when loading .ipynb files in the web IDE

Affected products

12
  • GitLab Inc./gitlab-web-ide-vscode-forkcpe-rescue2 versions
    cpe:2.3:a:gitlab:gitlab-web-ide-vscode-fork:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:gitlab:gitlab-web-ide-vscode-fork:*:*:*:*:*:*:*:*range: 0
    • (no CPE)range: <1.89.1-1.0.0-dev-20241118094343
  • GitLab Inc./GitLab8 versions
    cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*+ 7 more
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=15.11.0,<17.3.0
    • cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=15.11.0,<17.3.0
    • cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:17.4.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:17.5.0:*:*:*:enterprise:*:*:*
    • cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:community:*:*:*
    • cpe:2.3:a:gitlab:gitlab:17.6.0:*:*:*:enterprise:*:*:*
  • GitLab Inc./GitLab EE and CEllm-fuzzy
    Range: >=15.11,<17.3, and also 17.4, 17.5, 17.6
  • osv-coords
    pkg:bitnami/gitlab
    Range: >= 15.11.0, < 17.3.0

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.