Description

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

Classification

CVE ID: CVE-2023-6033

CVSS Base Severity: HIGH

CVSS Base Score: 8.7

Affected Products

Vendor: GitLab

Product: GitLab

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.05% (probability of being exploited)

EPSS Percentile: 20.28% (scored less or equal to compared to others)

EPSS Date: 2025-02-03 (when was this score calculated)

References

https://gitlab.com/gitlab-org/gitlab/-/issues/431201
https://hackerone.com/reports/2236039

Timeline