Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.7
CVE-2023-6033: GitLab lets attackers run scripts in users' browsers
CVE-2023-6033 · published 2 years ago
Summary
GitLab's connection to Jira does not properly clean data entered in its settings, so a malicious actor could place hidden code that runs in a viewer's web browser. This can let them steal information or impersonate the user. Upgrade to the latest GitLab release that includes the fix, or apply the vendor's recommended patch as soon as possible.
What to do
- Update gitlab to version 16.6.1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Bitnami | – | gitlab |
>= 16.6.0, < 16.6.1 Fix: upgrade to 16.6.1
|
| – | gitlab | gitlab |
>= 15.10, < 16.6.1 >= 16.4.0, < 16.4.3 >= 16.5.0, < 16.5.3 cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:* |
Original advisory text
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
References
- https://nvd.nist.gov/vuln/detail/CVE-2023-6033 Vendor Advisory
- https://gitlab.com/gitlab-org/gitlab/-/issues/431201 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/6xxx/CVE-2023-6033.j... Vendor Advisory
- https://hackerone.com/reports/2236039 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.7
High
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published1 Dec 2023
Updated4 Nov 2026
First seen10 Sep 2026
Track software like this
Free during beta