CVE-2023-2200

MEDIUM severity · CVSS 4.1 · CWE-116

4.1CVSS MEDIUM

Summary

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionRequired

Confidentiality impactNone

Integrity impactLow

Availability impactNone

Exploit probability (EPSS)1%

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N

Affected products we track (1)

GitLab

Recommendation

Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gitlab.com/gitlab-org/gitlab/-/issues/408281Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/408281Advisory
https://hackerone.com/reports/1935628Advisory
https://hackerone.com/reports/1935628Advisory