CVE-2023-6033

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

Affected

GitLab

CVSS v3.1 NVD

5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CVSS v3.1 GITLAB

8.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

EPSS

0.56% chance of exploitation in the next 30 days, 45th percentile

Published

2023-12-01

Updated

2025-11-20

Proof-of-concept exploits (1)

• https://hackerone.com/reports/2236039

Security advisories

• https://gitlab.com/gitlab-org/gitlab/-/issues/431201

References

• CVE Record
• NVD entry