CVE-2023-2164

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 15.9 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to trigger a stored XSS vulnerability via user interaction with a crafted URL in the WebIDE beta.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Aug 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-216407.8Memory corruption in Linux when the file upload API is called with parameters having large buffer.CVE-2023-216417.8An app with non-privileged access can change global system brightness and cause undesired system behavior.CVE-2023-216427.8Memory corruption in HAB Memory management due to broad system privileges via physical address.CVE-2023-216437.8Memory corruption due to untrusted pointer dereference in automotive during system call.CVE-2023-216447.8Memory corruption in RIL due to Integer Overflow while triggering qcril_uim_request_apdu request.CVE-2023-216467.5Transient DOS in Modem while processing invalid System Information Block 1.CVE-2023-216476.5Information disclosure in Bluetooth when an GATT packet is received due to improper input validation.CVE-2023-216487.8Memory corruption in RIL while trying to send apdu packet.CVE-2023-216497.8Memory corruption in WLAN while running doDriverCmd for an unspecific command.CVE-2023-216507.8Memory Corruption in GPS HLOS Driver when injectFdclData receives data with invalid data length.CVE-2023-216517.8Memory Corruption in Core due to incorrect type conversion or cast in secure_io_read/write function in TEE.CVE-2023-216527.1Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use.