CVE-2023-6033: Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3…

PriorityP426medium5.4CVSS 3.1

AVNACLPRLUIRSCCLILAN

EPSS

0.56%

42.3th percentile

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
debian	gitlab	< gitlab 16.4.4+ds2-2 (sid)	gitlab 16.4.4+ds2-2 (sid)
gitlab	gitlab	—	—
gitlab	gitlab	>= 15.10 < 16.4.3	16.4.3
gitlab	gitlab	>= 15.10 < 16.6.1	16.6.1
gitlab	gitlab	>= 16.4.0 < 16.4.3	16.4.3
gitlab	gitlab	>= 16.5 < 16.5.3	16.5.3
gitlab	gitlab	>= 16.5.0 < 16.5.3	16.5.3
gitlab	gitlab	>= 16.6 < 16.6.1	16.6.1
gitlab	gitlab_ce	—	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

osv5.4MEDIUM

vendor_debian8.7HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.