VULNERABILITY INTELLIGENCE

CVE-2019-11547

CVSS score6.1 MEDIUM

EPSS probability1.14%

CISA KEVNot currently listed

Published2019-09-09

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

An issue was discovered in GitLab Community and Enterprise Edition before 11.8.9, 11.9.x before 11.9.10, and 11.10.x before 11.10.2. It has Improper Encoding or Escaping of Output. The branch name on new merge request notification emails isn't escaped, which could potentially lead to XSS issues.

Weakness classification

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-116: Improper Encoding or Escaping of Output

Primary references

cve@mitre.org — Release Notes, Vendor Advisory
cve@mitre.org — Exploit, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Vendor Advisory