GitLab EE Cross-Site Scripting Vulnerability in Customizable Analytics Dashboards

A cross-site scripting vulnerability has been addressed in GitLab EE versions 18.7 prior to 18.9.7, 18.10 prior to 18.10.6, and 18.11 prior to 18.11.3. This issue allowed authenticated users to execute arbitrary JavaScript in the context of other users' browsers within customizable analytics dashboards, due to inadequate input sanitization.

Impact

Exploitation of this vulnerability allowed for cross-site scripting, where an attacker could inject malicious scripts that would be executed in the context of the victim's browser.

Remediation

Users can upgrade to GitLab EE versions 18.9.7, 18.10.6, or 18.11.3 to address this vulnerability.