CVE-2023-2442: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A…

PriorityP348medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

96.06%

99.9th percentile

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 15.10.8+ds1-2 (sid)	gitlab 15.10.8+ds1-2 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	—	—
gitlab	gitlab	>= 15.11.0 < 15.11.7	15.11.7
gitlab	gitlab	>= 16.0.0 < 16.0.2	16.0.2
gitlab	gitlab_ce	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Trigger vector is a specially crafted merge request submitted to GitLab CE/EE, which results in stored XSS executed on the client side — monitor merge request content for suspicious script payloads ↗
→Vulnerable GitLab CE/EE version ranges: >= 15.11 and < 15.11.7, or >= 16.0 and < 16.0.2 — flag instances running these versions ↗

·Debian 'sid' resolves the issue at package version 15.10.8+ds1-2, which is outside the upstream vulnerable range — verify package versioning independently when assessing Debian deployments ↗
·Scope is listed as 'local' in the Debian security tracker, which may affect risk scoring in certain deployment contexts ↗

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

osv5.4MEDIUM

vendor_debian8.7HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.