MEDIUM

CVE-2023-1836

Gitlab GitLab 2023-05-03 CVSS v3.1

CVSS

5.4

Description

A cross-site scripting issue has been discovered in GitLab affecting all versions starting from 5.1 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. When viewing an XML file in a repository in "raw" mode, it can be made to render as HTML if viewed under specific circumstances

Summary dbcve.org

GitLab contains a cross-site scripting vulnerability where XML files viewed in raw mode can be rendered as HTML under specific circumstances, allowing injection of malicious scripts.

Mitigation

Upgrade GitLab to version 15.9.6, 15.10.5, or 15.11.1 or later. Alternatively, restrict or disable raw file viewing for XML content until patched.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.75%

Probability of exploitation in next 30 days

53.5th percentile

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1836.json Third Party Advisory https://gitlab.com/gitlab-org/gitlab/-/issues/404613 Broken Link https://hackerone.com/reports/1923293 Permissions Required

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE