CVE-2023-3500
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
Summary dbcve.org
A reflected cross-site scripting (XSS) vulnerability in GitLab's PlantUML diagram rendering allows attackers to inject malicious scripts through specially crafted PlantUML diagrams. When victims view these diagrams, the embedded JavaScript executes in their browser context, potentially enabling session hijacking, credential theft, or actions on behalf of the authenticated user.
Mitigation
Upgrade GitLab to version 16.0.8, 16.1.3, 16.2.2 or later to patch the vulnerability. If immediate upgrade is not possible, consider disabling PlantUML integration until the patch can be applied.