MEDIUM
CVE-2023-2164
CVSS
5.4
Description
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
Summary dbcve.org
A stored cross-site scripting (XSS) vulnerability exists in GitLab's WebIDE beta feature. Attackers can inject malicious scripts through crafted URLs that get stored and executed when users interact with the WebIDE, potentially compromising sessions or stealing credentials.
Mitigation
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2 or later. If immediate upgrade is not feasible, disable the WebIDE beta feature as a temporary workaround.
Weakness (CWE)
CWE-79
Cross-site Scripting (XSS)
EPSS Score
64.98%
Probability of exploitation in next 30 days
99.2th percentile
References
Base CVE data derived from NVD (public domain). Enrichment by
dbcve.org
(CC-BY-4.0). Fetched via API.