Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab · GitLab
A stored cross-site scripting flaw in the WebIDE beta component of GitLab, affecting versions from 15.9 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. An attacker with low privileges can trigger it by getting a user to interact with a crafted URL, requiring no network-level access beyond reaching the GitLab instance.
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 1 Aug 2023. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.