CVE-2024-3092: 
GitLab vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in GitLab CE/EE affecting all versions from 16.9 before 16.9.4 and from 16.10 before 16.10.2. The vulnerability, identified as CVE-2024-3092, was discovered on April 10, 2024, and allows attackers to inject malicious payloads through the diff viewer feature (GitLab Release, Security Online).

The vulnerability is a stored XSS issue that occurs in the diff viewer component of GitLab. When exploited, it allows attackers to inject and store malicious scripts that execute when other users view affected diffs. The vulnerability has been assigned a CVSS v3.1 base score of 8.7 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N, indicating network accessibility, low attack complexity, and high impact on confidentiality and integrity (NVD).

The vulnerability enables attackers to perform arbitrary actions on behalf of victims who view the compromised diff viewer. This could lead to session hijacking, data theft, and unauthorized system access. The stored nature of the XSS makes it particularly dangerous as the malicious payload persists on the server and affects any user who accesses the compromised page (Security Online).

The vulnerability requires an attacker to have low privileges and user interaction for successful exploitation. The attack can be executed remotely through network access, making it accessible to any authenticated user with the ability to create or modify content in the diff viewer (NVD).

GitLab has released patches to address this vulnerability in versions 16.10.2, 16.9.4, and 16.8.6. GitLab.com has already been updated to run the patched version. Organizations running GitLab CE or EE are strongly recommended to upgrade immediately to one of these patched versions to mitigate the risk (GitLab Release).