CVE-2023-1072

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. It was possible to trigger a resource depletion attack due to improper filtering for number of requests to read commits details.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=9.0, <15.7.8; >=15.8, <15.8.4; >=15.9, <15.9.2

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1072.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/219619Broken Link
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1072.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/219619Broken Link

Timeline

Published: Mar 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-10736.6A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device CVE-2023-10745.5A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. This issue may occur when a user starts a malicious CVE-2023-10753.3A flaw was found in the Linux Kernel. The tls_is_tx_ready() incorrectly checks for list emptiness, potentially accessing a type confused ent CVE-2023-10765.5A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initializati CVE-2023-10777.0In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wil CVE-2023-10787.8A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. The rds_rm_zerocopy_callback() uses list_entry() on the he CVE-2023-10796.8A flaw was found in the Linux kernel. A use-after-free may be triggered in asus_kbd_backlight_set when plugging/disconnecting in a malicious CVE-2023-10806.1The GN Publisher plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘tab’ parameter in versions up to, and includi CVE-2023-10814.8Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.CVE-2023-10828.8An remote attacker with low privileges can perform a command injection which can lead to root access.CVE-2023-10839.8An unauthenticated remote attacker who is aware of a MQTT topic name can send and receive messages, including GET/SET configuration command CVE-2023-10842.7An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versio