CVE-2023-0319

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1, allowing to read environment names supposed to be restricted to project memebers only.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863 CWE-284

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=13.6, <15.8.5; >=15.9, <15.9.4; >=15.10, <15.10.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0319.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/388096Broken Link
https://hackerone.com/reports/1817586Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0319.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/388096Broken Link
https://hackerone.com/reports/1817586Permissions Required

Timeline

Published: Apr 5, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-03205.4Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Izmir Katip Celebi University UBYS all CVE-2023-03219.1Campbell Scientific dataloggers CR6, CR300, CR800, CR1000 and CR3000 may allow an attacker to download configuration files, which may contai CVE-2023-03226.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected CVE-2023-03235.4Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.14.CVE-2023-03249.8A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. Affected by this issue CVE-2023-03256.1Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. This is possible because the appl CVE-2023-03264.3An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization heade CVE-2023-03276.1A vulnerability was found in saemorris TheRadSystem. It has been classified as problematic. Affected is an unknown function of the file user CVE-2023-03284.3The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce.CVE-2023-03297.2The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools mo CVE-2023-03306.0A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bug CVE-2023-03317.5The Correos Oficial WordPress plugin through 1.2.0.2 does not have an authorization check user input validation when generating a file path,