CVE-2023-2015 is a medium-severity vulnerability discovered in GitLab CE/EE, affecting various versions of the software. This issue, known as a reflected Cross-Site Scripting (XSS) vulnerability, allows attackers to perform actions on behalf of victims when creating new abuse reports. Systems running GitLab CE/EE versions from 15.8.0 up to 15.10.7, from 15.11.0 up to 15.11.6, and from 16.0.0 up to 16.0.1 are impacted by this vulnerability.

How do I know if I'm affected?

To determine if you're affected by the vulnerability, check if you're using GitLab CE/EE software. The affected versions include those from 15.8.0 up to 15.10.7, from 15.11.0 up to 15.11.6, and from 16.0.0 up to 16.0.1. This vulnerability is a reflected Cross-Site Scripting (XSS) issue that occurs when creating new abuse reports, allowing attackers to perform actions on behalf of victims. If your GitLab CE/EE version falls within these ranges, you may be at risk.

What should I do if I'm affected?

If you're affected by the vulnerability, it's crucial to update your GitLab CE/EE software to a secure version. Identify your current GitLab version. Check if it falls within the affected ranges. If so, update to a newer version that has fixed the vulnerability, such as 15.10.8, 15.11.7, or 16.0.2.

Is CVE-2023-2015 in CISA’s Known Exploited Vulnerabilities Catalog?

As of now, CVE-2023-2015 is not listed in CISA's Known Exploited Vulnerabilities Catalog. This medium-severity vulnerability, known as a reflected Cross-Site Scripting (XSS) issue, affects certain versions of GitLab CE/EE software. It allows attackers to perform actions on behalf of victims when creating new abuse reports. There is no specific due date or required action mentioned, but updating your GitLab software to a secure version is recommended to mitigate the risk.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-79, which details a Cross-Site Scripting (XSS) vulnerability in GitLab CE/EE, allowing attackers to perform actions on behalf of victims.

For more details

CVE-2023-2015 is a medium-severity vulnerability affecting GitLab CE/EE software, posing a risk to users with affected versions. For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the NVD page or the resources listed below.

• GitLab CVE-2023-2015 JSON File

• GitLab Issue: Reflected XSS in Report Abuse Functionality

• HackerOne Report (Sign in required)