CVE-2018-9244

Name	CVE-2018-9244
Description	GitLab Community and Enterprise Editions version 9.2 up to 10.4 are vulnerable to XSS because a lack of input validation in the milestones component leads to cross site scripting (specifically, data-milestone-id in the milestone dropdown feature). This is fixed in 10.6.3, 10.5.7, and 10.4.7.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	894868

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
gitlab (PTS)	sid	16.8.4-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
gitlab	source	stretch	(not affected)
gitlab	source	(unstable)	10.6.3+dfsg-1			894868

Notes

[stretch] - gitlab <not-affected> (Vulnerable code introduced in 9.2)
https://about.gitlab.com/2018/04/04/security-release-gitlab-10-dot-6-dot-3-released/