Loading vulnerability…
Stored XSS in GitLab Jira Integration Configuration
CVE-2023-6033 is a stored cross-site scripting (XSS) vulnerability in the Jira integration configuration of GitLab Community Edition (CE) and Enterprise Edition (EE). The vulnerability is due to improper neutralization of user input, allowing an attacker to inject malicious JavaScript code into the Jira integration configuration. This affects all versions from 15.10 prior to 16.6.1, 16.5 prior to 16.5.3, and 16.4 prior to 16.4.3.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can exploit this vulnerability to execute arbitrary JavaScript in the context of a victim's browser. This can lead to session hijacking, credential theft, or other actions performed with the victim's privileges within the GitLab application.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict access to the Jira integration configuration to trusted users only and monitor for suspicious activity. Consider disabling the Jira integration feature until the patch can be applied.
Patch, then assume compromise.
Upgrade GitLab CE/EE to version 16.6.1, 16.5.3, or 16.4.3 or later, depending on your release branch. These versions contain the fix for the vulnerability.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.