CVE-2023-3500
MediumCVSS 4.8Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
An issue has been discovered in GitLab CE/EE affecting versions from 10.0 before 16.0.8, from 16.1 before 16.1.3, and from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams, allowing attackers to perform arbitrary actions on behalf of victims.
Risk Assessment
This vulnerability could lead to account takeover, posing a serious threat to data security within the organization.
Recommendation
It is recommended to update GitLab to the latest version to mitigate this vulnerability and to monitor user activity for potential abuse.
Original NVD description (English source)
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.