CVE-2023-0223

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Non-project members could retrieve release descriptions via the API, even if the release visibility is restricted to project members only in the project settings.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected software

No affected versions have been published.

Timeline

Published: Mar 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-02249.8The GiveWP WordPress plugin before 2.24.1 does not properly escape user input before it reaches SQL queries, which could let unauthenticated CVE-2023-02254.3A flaw was found in Samba. An incomplete access check on dnsHostName allows authenticated but otherwise unprivileged users to delete this at CVE-2023-02276.5Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.CVE-2023-02288.8Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.CVE-2023-02296.3A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-pr CVE-2023-02305.4The VK All in One Expansion Unit WordPress plugin before 9.86.0.0 does not validate and escape some of its block options before outputting t CVE-2023-02315.4The ShopLentor WordPress plugin before 2.5.4 does not validate and escape some of its block options before outputting them back in a page/po CVE-2023-02329.8The ShopLentor WordPress plugin before 2.5.4 unserializes user input from cookies in order to track viewed products and user data, which cou CVE-2023-02335.4The ActiveCampaign WordPress plugin before 8.1.12 does not validate and escape some of its block options before outputting them back in a pa CVE-2023-02348.8The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an a CVE-2023-02366.1The Tutor LMS WordPress plugin before 2.0.10 does not sanitise and escape the reset_key and user_id parameters before outputting then back i CVE-2023-02385.5Due to lack of a security policy, the WARP Mobile Client (<=6.29) for Android was susceptible to this vulnerability which allowed a maliciou