GitLab CE/EE Cross-Site Scripting Vulnerability in Swagger UI

A cross-site scripting vulnerability has been identified in GitLab Community Edition (CE) and Enterprise Edition (EE) versions 15.11 prior to 18.4.6, 18.5 prior to 18.5.4, and 18.6 prior to 18.6.2. This vulnerability could allow an unauthenticated user to perform unauthorized actions on behalf of another user by injecting malicious external scripts into the Swagger UI.

Impact

Exploitation of this vulnerability could lead to cross-site scripting, allowing for the injection of malicious scripts that could be executed in the context of the user's browser.

Remediation

Users are advised to upgrade to GitLab versions 18.6.2, 18.5.4, or 18.4.6. Instructions for updating GitLab can be found on the GitLab Update page. For GitLab Runner, refer to the Updating the Runner page.