CVE-2024-4835

Deeper analysis

A cross-site scripting vulnerability tracked as CVE-2024-4835 affects GitLab versions 15.11 prior to 16.10.6, 16.11 prior to 16.11.3, and 17.0 prior to 17.0.1. The flaw, classified under CWE-79, permits an attacker to craft a malicious page that triggers the XSS condition and exfiltrates sensitive user information. It carries a CVSS 3.1 base score of 8.0 reflecting network attack vector, high complexity, no required privileges, required user interaction, changed scope, and high impact on confidentiality and integrity.

An unauthenticated remote attacker can exploit the issue by inducing a victim to interact with the malicious page, enabling theft of sensitive data without needing direct access to the GitLab instance. The attack achieves information disclosure and potential integrity violations through the reflected or stored XSS vector.

Official references point to GitLab issue 461328 and the associated HackerOne report 2497024, which document the affected releases and indicate that remediation is achieved by upgrading to the fixed versions listed above. The EPSS score reached a peak of 0.0981 with a current value of 0.0745, indicating modest post-disclosure interest without evidence of widespread exploitation.