CVE-2023-1071

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions from 15.5 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. Due to improper permissions checks it was possible for an unauthorised user to remove an issue from an epic.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863CWE-400

Affected software

No affected versions have been published.

Timeline

Published
Apr 5, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-10725.3An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4CVE-2023-10736.6A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB deviceCVE-2023-10745.5A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a maliciousCVE-2023-10753.3A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused entCVE-2023-10765.5A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initializatiCVE-2023-10777.0In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wilCVE-2023-10787.8A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the heCVE-2023-10796.8A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a maliciousCVE-2023-10806.1The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and includiCVE-2023-10814.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-10828.8An remote attacker with low privileges can perform a command injection which can lead to root access.CVE-2023-10839.8An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration command
CVE-2023-1071: Medium severity, CVSS 4.3 | Vulnix