CVE-2023-2200

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2023-2200
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-2200.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2023-2200
Aliases
Downstream
Published
2023-07-13T02:02:34.411Z
Modified
2025-11-29T14:53:30.990037Z
Severity
  • 4.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N CVSS Calculator
Summary
Improper Encoding or Escaping of Output in GitLab
Details

An issue has been discovered in GitLab CE/EE affecting all versions starting from 7.14 before 15.11.10, all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows an attacker to inject HTML in an email address field.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/2xxx/CVE-2023-2200.json",
    "cna_assigner": "GitLab",
    "cwe_ids": [
        "CWE-116"
    ]
}
References

Affected packages

Git / gitlab.com/gitlab-org/gitlab

Affected ranges

Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
002833d63c2a43cb3499d1f1175d0d34a7b70f8d
Fixed
6d037533ce72e8b309efcb41b2801a3c8244789d
Database specific 
{
    "versions": [
        {
            "introduced": "7.14"
        },
        {
            "fixed": "15.11.10"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
280a09dbca836a6eedf5da1e63953fe8da44bf4c
Fixed
1ca31874e42fbd4b99f6e3c9174a992c053c8e1b
Database specific 
{
    "versions": [
        {
            "introduced": "16.0"
        },
        {
            "fixed": "16.0.6"
        }
    ]
}
Type
GIT
Repo
https://gitlab.com/gitlab-org/gitlab
Events
Introduced
4961ad113f3afe23965ac12285eaab31315ab0c6
Fixed
d3582d7719f503ba7e038a1b2e0443a89ddb6429
Database specific 
{
    "versions": [
        {
            "introduced": "16.1"
        },
        {
            "fixed": "16.1.1"
        }
    ]
}

Affected versions

v16.*

v16.0.0-ee
v16.0.1-ee
v16.0.2-ee
v16.0.3-ee
v16.0.4-ee
v16.0.5-ee
v16.1.0-ee

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-2200.json"