What is CVE-2023-2200?

CVE-2023-2200 is a medium-severity vulnerability in Gitlab, classified under Improper Encoding or Escaping of Output. CVSS score: 4.1/10. Published 2023-07-13.

How severe is CVE-2023-2200?

Medium severity. CVSS v3 base score is 4.1 out of 10.

XSS in Gitlab

CVE-2023-2200

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

EPSS: 0.005 (37.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N.

Affected products

Gitlab — versions 7.14, 16.0, 16.1

Weakness classification (CWE)

CWE-116 — Improper Encoding or Escaping of Output
CWE-79 — Cross-site Scripting

References

cve@gitlab.com (issue-tracking, Broken Link, Vendor Advisory)
cve@gitlab.com (technical-description, Third Party Advisory, exploit)

Frequently asked questions

What is CVE-2023-2200?: CVE-2023-2200 is a medium-severity vulnerability in Gitlab, classified under Improper Encoding or Escaping of Output. CVSS score: 4.1/10. Published 2023-07-13.
How severe is CVE-2023-2200?: Medium severity. CVSS v3 base score is 4.1 out of 10.