CVE-2023-3500
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 4.8EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
02 Aug 2023Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
GitLab · GitLabWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →