Medium severity5.4NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026
CVE-2023-2164
CVE-2023-2164
Description
An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.
Affected products
5cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 15.9
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=15.9,<16.0.8
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=15.9,<16.0.8
- (no CPE)range: 15.9 <= v < 16.0.8, 16.1 <= v < 16.1.3, 16.2 <= v < 16.2.2
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/407783nvdBroken Link
- hackerone.com/reports/1940598nvdPermissions Required
News mentions
1- GitLab Security Release: 16.2.2, 16.1.3, and 16.0.8GitLab Security Releases · Aug 1, 2023