An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions…
GitLab · GitLab
GitLab CE/EE contains a stored cross-site scripting flaw, classified as improper neutralization of input during web page generation, that affects versions from 15.11 before 15.11.7 and from 16.0 before 16.0.2. An attacker who submits a specially crafted merge request can have malicious script execute in the browser of a victim, letting it perform arbitrary actions on the victim's behalf; this requires the attacker to have low-privilege access to the platform and the victim to interact with the merge request.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 7 Jun 2023. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.