CVE-2018-14655: Cross-site Scripting

November 13, 2018 (updated October 9, 2019)

When using response_mode=form_post it is possible to inject arbitrary Javascript-Code via the state-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

References

access.redhat.com/errata/RHSA-2018:3592
access.redhat.com/errata/RHSA-2018:3593
access.redhat.com/errata/RHSA-2018:3595
bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14655
nvd.nist.gov/vuln/detail/CVE-2018-14655

Code Behaviors & Features

Detect and mitigate CVE-2018-14655 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →