CVE-2023-0508

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. Open redirection was possible via HTTP response splitting in the NPM package API.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-113

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.9, <15.10.8; >=15.11, <15.11.7; >=16.0, <16.0.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0508.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/389328Broken Link
https://hackerone.com/reports/1842314Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-0508.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/389328Broken Link
https://hackerone.com/reports/1842314Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/389328Broken Link

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-05097.4Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.CVE-2023-05119.8Relative Path Traversal vulnerability in ForgeRock Access Management Java Policy Agent allows Authentication Bypass. This issue affects Acce CVE-2023-05127.8Divide By Zero in GitHub repository vim/vim prior to 9.0.1247.CVE-2023-05135.4A vulnerability has been found in isoftforce Dreamer CMS up to 4.0.1 and classified as problematic. This vulnerability affects unknown code.CVE-2023-05146.1The Membership Database WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading CVE-2023-05157.2A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0 and classified as critical. This issue affects some CVE-2023-05167.2A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an CVE-2023-05187.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7 before CVE-2023-05195.4Cross-site Scripting (XSS) - Stored in GitHub repository modoboa/modoboa prior to 2.0.4.CVE-2023-05205.4The RapidExpCart WordPress plugin through 1.0 does not sanitize and escape the url parameter in the rapidexpcart endpoint before storing it CVE-2023-05226.5The Enable/Disable Auto Login when Register WordPress plugin through 1.1.0 does not have CSRF check in place when updating its settings, whi CVE-2023-05236.1An issue has been discovered in GitLab affecting all versions starting from 15.6 before 15.8.5, 15.9 before 15.9.4, and 15.10 before 15.10.1