Unrated severityNVD Advisory· Published Dec 1, 2023· Updated Nov 20, 2025
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
CVE-2023-6033
Description
Improper neutralization of input in Jira integration configuration in GitLab CE/EE, affecting all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3 allows attacker to execute javascript in victim's browser.
Affected products
3- Range: >=15.10 <16.6.1, >=16.5 <16.5.3, >=16.4 <16.4.3
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- hackerone.com/reports/2236039mitretechnical-descriptionexploitpermissions-required
- gitlab.com/gitlab-org/gitlab/-/issues/431201mitreissue-trackingpermissions-required
News mentions
1- GitLab Security Release: 16.6.1, 16.5.3, 16.4.3GitLab Security Releases · Nov 30, 2023