CVE-2017-1000392: Cross-site Scripting

January 26, 2018 (updated May 8, 2019)

Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than characters.

References

www.securityfocus.com/bid/101773
www.securityfocus.com/bid/102826
jenkins.io/security/advisory/2017-11-08/
nvd.nist.gov/vuln/detail/CVE-2017-1000392

Code Behaviors & Features

Detect and mitigate CVE-2017-1000392 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →