MEDIUM

CVE-2023-6033

Gitlab GitLab 2023-12-01 CVSS v3.1

CVSS

5.4

Description

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

Summary dbcve.org

This is a stored Cross-Site Scripting (XSS) vulnerability in GitLab's Jira integration configuration. The Jira integration settings fail to properly sanitize input fields, allowing an attacker to inject malicious JavaScript that executes when other users view the Jira integration configuration page in their browsers.

Mitigation

Upgrade GitLab to version 16.6.1, 16.5.3, 16.4.3 or later. Until upgraded, limit access to Jira integration configuration settings to trusted administrators only.

Weakness (CWE)

CWE-79 Cross-site Scripting (XSS)

EPSS Score

0.56%

Probability of exploitation in next 30 days

45.3th percentile

References

https://gitlab.com/gitlab-org/gitlab/-/issues/431201 Broken Link, Vendor Advisory https://hackerone.com/reports/2236039 Permissions Required, Third Party Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE