CVE-2023-5933: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-01-26 · updated 2026-06-17
Weakness: CWE-80

Description

An issue has been discovered in GitLab CE/EE affecting all versions after 13.7 before 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1. Improper input sanitization of user name allows arbitrary API PUT requests.

Affected products

GitLab: from 13.7.0 before 16.6.6; from 16.7.0 before 16.7.4; 16.8.0 — fixed in 16.6.6, 16.7.4

How to fix

Upgrade to a fixed version: GitLab 16.6.6, 16.7.4. Check the vendor advisory for mitigations.

References

https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/430236
https://hackerone.com/reports/2225710
https://about.gitlab.com/releases/2024/01/25/critical-security-release-gitlab-16-8-1-released/
https://gitlab.com/gitlab-org/gitlab/-/issues/430236
https://hackerone.com/reports/2225710

Get alerted when CVE-2023-5933 or the next vulnerability affects your stack