CVE-2023-2200

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-116 CWE-79

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 7.14, < 15.11.10; >= 16.0, < 16.0.6; >= 16.1, < 16.1.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/408281Broken Link, Vendor Advisory
https://hackerone.com/reports/1935628Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/408281Broken Link, Vendor Advisory
https://hackerone.com/reports/1935628Third Party Advisory

Timeline

Published: Jul 13, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-220004.6Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prio CVE-2023-220014.6Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prio CVE-2023-220026.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prio CVE-2023-220033.3Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). Supported versions that are affected are 10 and 11. Ea CVE-2023-220044.3Vulnerability in the Oracle Applications Technology product of Oracle E-Business Suite (component: Reports Configuration). Supported versio CVE-2023-220054.4Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.33 CVE-2023-220063.1Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition, Oracle GraalVM for JDK product of Oracle Java SE (component: Network CVE-2023-220074.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.7.41 CVE-2023-220084.9Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.33 and prior. E CVE-2023-220094.3Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workforce Management). Supported ve CVE-2023-22018.8The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due CVE-2023-220102.2Vulnerability in Oracle Essbase (component: Security and Provisioning). The supported version that is affected is 21.4.3.0.0. Difficult to