XSS vulnerability in GitLab prior to 6.5.0
blog.gitlab.org
XSS vulnerability in GitLab prior to 6.5.0
1–4 of 4 posts
Re: XSS vulnerability in GitLab prior to 6.5.0
#2CVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...
Re: XSS vulnerability in GitLab prior to 6.5.0
#3Looks like this is the fix:
https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...
Re: XSS vulnerability in GitLab prior to 6.5.0
#4That's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.