XSS vulnerability in GitLab prior to 6.5.0 (blog.gitlab.org)

27 points by alsutton010203 12y ago ↗ HN

3 comments

[ 2.7 ms ] story [ 15.8 ms ] thread

Ysx 12y ago ↗

CVE and exploit at http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-731...

Looks like this is the fix: https://github.com/gitlabhq/gitlabhq/commit/d6c037de81096680...

That's quite surprising, it's a textbook XSS vulnerability. It seems to me that their markdown library should escape entities by default or they will have many other vulns.