CVE-2023-6371: Stored-XSS injected in Wiki page via Banzai pipeline
An issue has been discovered in GitLab CE/EE affecting all versions before 16.8.5, all versions starting from 16.9 before 16.9.3, all versions starting from 16.10 before 16.10.1. A wiki page with a crafted payload may lead to a Stored XSS, allowing attackers to perform arbitrary actions on behalf of victims.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2023-6371?
CVE-2023-6371 has been classified with a high severity due to the potential for stored XSS attacks.
How do I fix CVE-2023-6371?
To fix CVE-2023-6371, upgrade GitLab to version 16.8.5 or to version 16.9.3 or later for the 16.9 and 16.10 branches.
What versions of GitLab are affected by CVE-2023-6371?
All versions of GitLab before 16.8.5 and versions starting from 16.9 before 16.9.3, as well as 16.10 before 16.10.1 are affected by CVE-2023-6371.
Can CVE-2023-6371 allow an attacker to execute arbitrary code?
Yes, CVE-2023-6371 can allow attackers to perform arbitrary actions through a crafted payload due to stored XSS vulnerabilities.
Is CVE-2023-6371 a concern for both GitLab CE and EE?
Yes, CVE-2023-6371 affects both GitLab Community Edition (CE) and Enterprise Edition (EE) versions.