Lucene search

GoogleOSV:BIT-GITLAB-2023-6033

HistoryMar 06, 2024 - 10:55 a.m.

BIT-gitlab-2023-6033

2024-03-0610:55:22

Google

osv.dev

input neutralization

gitlab ce

gitlab ee

jira integration

security vulnerability

javascript execution

software bug

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

27.4%

JSON

Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim’s browser.

References

gitlab.com/gitlab-org/gitlab/-/issues/431201

hackerone.com/reports/2236039

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

27.4%

JSON

Related for OSV:BIT-GITLAB-2023-6033