Improper Neutralization of Input During Web Page Generation… (CVE-2023-6033)

Summary

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

Original description

The description as published by the source.

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Affected packages

Bitnami gitlab

[{"type":"SEMVER","events":[{"introduced":"15.10.0"},{"fixed":"16.4.3"},{"introduced":"16.5.0"},{"fixed":"16.5.3"},{"introduced":"16.6.0"},{"fixed":"16.6.1"}]}]

References

advisory gitlab.com
advisory hackerone.com
web nvd.nist.gov