An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting…
GitLab · GitLab
GitLab's Kroki diagram rendering feature contains a flaw that allows a specially crafted diagram to inject stored cross-site scripting into the client-side interface. The affected range covers GitLab versions from 13.7 before 15.7.8, from 15.8 before 15.8.4, and from 15.9 before 15.9.2. An attacker with low-privilege authenticated access who can get a victim to view the malicious diagram can run scripts in the victim's session and perform arbitrary actions on their behalf, which requires user interaction.
An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 9 Mar 2023. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.