CVE-2023-2164
Published: 02 August 2023
Summary
CVE-2023-2164 is a medium-severity Cross-site Scripting (CWE-79) vulnerability in Gitlab Gitlab. Its CVSS base score is 5.4 (Medium).
Operationally, ranked in the top 2.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, and all versions starting from 16.2 before 16.2.2. The vulnerability is a stored cross-site scripting flaw (CWE-79) that can be triggered in the WebIDE beta through user interaction with a crafted URL, rated at CVSS 5.4 with network attack vector, low complexity, and required user interaction.
An authenticated attacker can supply the malicious URL to a target user; if the user engages with it inside the WebIDE beta, the stored XSS executes in the victim's browser context, enabling limited impacts on confidentiality and integrity under the reported scope change.
The referenced GitLab issue 407783 and HackerOne report 1940598 document the flaw and point to the availability of patched releases that remediate the exposure. The associated EPSS score has remained flat at its peak value of 0.5217 with no material post-disclosure rise observed.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-33681
Vulnerability details
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS…
more
vulnerability via user interaction with a crafted URL in the WebIDE beta.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Penetration testing submits XSS payloads to web applications, detecting cross-site scripting flaws for subsequent remediation.
Validates web inputs to reject script-related content that could produce XSS.
Output validation against expected content can reject or sanitize script content in generated web pages, reducing XSS exploitability.