CVE-2023-2164

published 2023-08-02

CVE-2023-2164: An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions…

Priority P3 43 medium 5.4 CVSS 3.1

AV N AC L PR L UI R S C C L I L A N

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 16.0.8+ds1-1 (sid)	gitlab 16.0.8+ds1-1 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	>= 15.9 < 16.0.8	16.0.8
gitlab	gitlab	>= 16.1 < 16.1.3	16.1.3
gitlab	gitlab	>= 16.1.0 < 16.1.3	16.1.3
gitlab	gitlab	>= 16.2 < 16.2.2	16.2.2
gitlab	gitlab	>= 16.2.0 < 16.2.2	16.2.2

Detection & IOCs extracted from sources · hover to see the quote

• → Stored XSS triggered via user interaction with a crafted URL in the GitLab WebIDE beta feature — monitor for suspicious or anomalous URL patterns submitted to or rendered within the WebIDE beta endpoint. ↗

• · Affected GitLab versions are 15.9 up to (not including) 16.0.8, 16.1 up to (not including) 16.1.3, and 16.2 up to (not including) 16.2.2. Instances running patched versions (≥16.0.8, ≥16.1.3, ≥16.2.2) are not vulnerable. ↗
• · The GitLab package used in OpenShift (a GitLab API NodeJS library) is NOT affected by this CVE — do not apply GitLab remediation to OpenShift Console packages. ↗

CVSS provenance

nvd v3.1 5.4 MEDIUM CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

osv 5.4 MEDIUM

vendor_debian 5.4 MEDIUM

vendor_redhat 5.4 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79