Security readout for executives and security teams
Plain-English summary
This CVE affects older GitLab Community and Enterprise Edition releases. A merge request page could mishandle filenames in the changes tab, allowing cross-site scripting in a user’s browser. The source bundle names fixed releases. There is no provided evidence of active exploitation.
Executive priority
Address during normal vulnerability remediation, faster for internet-facing or shared GitLab environments. The issue is old and fixed, but lingering legacy GitLab deployments remain the main business risk.
Technical view
GitLab CE/EE versions 8.4 up to 10.4 had insufficient input validation in the merge request component. The reported XSS vector involved filenames displayed in merge request changes tabs. GitLab states fixes are available in 10.6.3, 10.5.7, and 10.4.7.
Likely exposure
Exposure is limited to organizations still running GitLab CE/EE 8.4 through 10.4, especially where merge requests can be created or viewed by untrusted users.
Exploitation context
The bundle does not show CISA KEV listing, public active exploitation, CVSS scoring, or detailed exploit maturity. Treat this as a browser-side trust-boundary issue in GitLab merge request workflows.
Researcher notes
The affected surface is the merge request changes tab filename rendering path. Source data lacks CVSS, CWE, exploit status, and deeper technical detail, so assessment should stay bounded to the vendor and CVE statements.
Mitigation direction
- Upgrade GitLab to 10.6.3, 10.5.7, 10.4.7, or later.
- Prioritize externally reachable or broadly used GitLab instances.
- If stuck on legacy versions, check GitLab guidance for supported upgrade paths.
- Limit untrusted merge request activity until affected instances are upgraded.
Validation and detection
- Inventory all GitLab CE/EE instances and record exact versions.
- Confirm no instance remains on versions 8.4 through 10.4 before fixed releases.
- Review GitLab’s April 4, 2018 security release notes.
- Validate merge request workflows after upgrade in a test environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2018-9243 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://gitlab.com/gitlab-org/gitlab-ce/issues/42028CVE reference · x_refsource_CONFIRM
- https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.