CVE-2023-1204

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A user could use an unverified email as a public email and commit email by sending a specifically crafted request on user update settings.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=10.0, <12.9.8; >=12.10, <12.10.7; >=13.0, <13.0.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1204.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/394745Broken Link
https://hackerone.com/reports/1881598Permissions Required
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1204.jsonThird Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/394745Broken Link
https://hackerone.com/reports/1881598Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/394745Broken Link

Timeline

Published: May 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12058.8NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly im CVE-2023-12065.7A hash collision flaw was found in the IPv6 connection lookup table in the Linux kernel’s IPv6 functionality when a user makes a new kind of CVE-2023-12077.2This HTTP Headers WordPress plugin before 1.18.8 has an import functionality which executes arbitrary SQL on the server, leading to an SQL I CVE-2023-12087.2This HTTP Headers WordPress plugin before 1.18.11 allows arbitrary data to be written to arbitrary files, leading to a Remote Code Execution CVE-2023-12095.4Cross-Site Scripting (XSS) vulnerabilities exist in ServiceNow records allowing an authenticated attacker to inject arbitrary scripts.CVE-2023-12104.3An issue has been discovered in GitLab affecting all versions starting from 12.9 before 16.0.8, all versions starting from 16.1 before 16.1.CVE-2023-12117.2SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-12124.8Cross-site Scripting (XSS) - Stored in GitHub repository phpipam/phpipam prior to v1.5.2.CVE-2023-12138.8Use after free in Swiftshader in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a CVE-2023-12148.8Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2023-12158.8Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2023-12168.8Use after free in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had convienced the user to engage in direct