Medium severity4.8NVD Advisory· Published Aug 2, 2023· Updated Jun 17, 2026
CVE-2023-3500
CVE-2023-3500
Description
An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. A reflected XSS was possible when creating specific PlantUML diagrams that allowed the attacker to perform arbitrary actions on behalf of victims.
Affected products
5cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*range: 10.0
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:community:*:*:*range: >=10.0,<16.0.8
- cpe:2.3:a:gitlab:gitlab:*:*:*:*:enterprise:*:*:*range: >=10.0,<16.0.8
- Range: starting from 10.0 before 16.0.8, starting from 16.1 before 16.1.3, starting from 16.2 before 16.2.2
Patches
Vulnerability mechanics
References
2- gitlab.com/gitlab-org/gitlab/-/issues/416902nvdBroken Link
- hackerone.com/reports/2010926nvdPermissions Required
News mentions
1- GitLab Security Release: 16.2.2, 16.1.3, and 16.0.8GitLab Security Releases · Aug 1, 2023