CVE-2023-2442: XSS
An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 15.11.7 - Upgrade
Upgrade
GitLab CE/EEto a version that resolves this vulnerability.Fixed in 16.0.2
Event History
Frequently Asked Questions
What is the vulnerability ID for this GitLab issue?
The vulnerability ID for this GitLab issue is CVE-2023-2442.
What is the severity of CVE-2023-2442?
The severity of CVE-2023-2442 is high with a score of 5.4.
Which versions of GitLab are affected by CVE-2023-2442?
All versions starting from 15.11 before 15.11.7, and all versions starting from 16.0 before 16.0.2 of GitLab are affected by CVE-2023-2442.
What is the impact of CVE-2023-2442?
A specially crafted merge request could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims.
How can I fix the vulnerability CVE-2023-2442?
To fix the vulnerability CVE-2023-2442, update GitLab to version 15.11.7 or later for versions 15.11.x, and update to version 16.0.2 or later for versions 16.0.x.