CVE-2023-1265

MediumCVSS 4.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 11.9 before 15.9.6, all versions starting from 15.10 before 15.10.5, all versions starting from 15.11 before 15.11.1. The condition allows for a privileged attacker, under certain conditions, to obtain session tokens from all users of a GitLab instance.

Metrics

CVSS 3.1 4.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-384

Affected software

No affected versions have been published.

Timeline

Published: May 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-12679.8Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ulkem Company PtteM Kart. This issue CVE-2023-12699.8Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments prior to 1.5.0.CVE-2023-12705.4Cross-site Scripting in GitHub repository btcpayserver/btcpayserver prior to 1.8.3.CVE-2023-12738.8The ND Shortcodes WordPress plugin before 7.0 does not validate some shortcode attributes before using them to generate paths passed to incl CVE-2023-12746.5The Pricing Tables For WPBakery Page Builder (formerly Visual Composer) WordPress plugin before 3.0 does not validate some shortcode attribu CVE-2023-12756.1A vulnerability classified as problematic was found in SourceCodester Phone Shop Sales Managements System 1.0. This vulnerability affects un CVE-2023-12767.2A vulnerability, which was classified as critical, has been found in SUL1SS_shop. This issue affects some unknown processing of the file app CVE-2023-12777.8A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the funct CVE-2023-12786.1A vulnerability, which was classified as problematic, has been found in IBOS up to 4.5.5. Affected by this issue is some unknown functionali CVE-2023-12796.1An issue has been discovered in GitLab affecting all versions starting from 4.1 before 16.1.5, all versions starting from 16.2 before 16.2.5 CVE-2023-12817.8Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can CVE-2023-12826.1The Drag and Drop Multiple File Upload PRO - Contact Form 7 Standard WordPress plugin before 2.11.1 and Drag and Drop Multiple File Upload P