CVE-2018-3748: Cross-site Scripting

July 3, 2018 (updated August 28, 2018)

There is a Stored XSS vulnerability in the glance node module versions. File name, which contains malicious HTML (eg. embedded iframe element or javascript: pseudo-protocol handler in <a> element) allows to execute JavaScript code against any user who opens a directory listing containing such crafted file name.

References

nvd.nist.gov/vuln/detail/CVE-2018-3748

Code Behaviors & Features

Detect and mitigate CVE-2018-3748 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →