CVE-2023-1621

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 12.0 before 15.10.5, all versions starting from 15.11 before 15.11.1. A malicious group member may continue to commit to projects even from a restricted IP address.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected software

Vendor	Product	Versions
GitLab	GitLab	>=12.0, <15.10.5; >=15.11, <15.11.1

References

https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1621.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/399774Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1914049Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/cves/-/blob/master/2023/CVE-2023-1621.jsonVendor Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/399774Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1914049Permissions Required, Third Party Advisory

Timeline

Published: Jun 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-16236.5The Custom Post Type UI WordPress plugin before 1.13.5 does not properly check for CSRF when sending the debug information to a user supplie CVE-2023-16246.5The WPCode WordPress plugin before 2.0.9 has a flawed CSRF when deleting log, and does not ensure that the file to be deleted is inside the CVE-2023-16255.0An information leak was discovered in OpenStack heat. This issue could allow a remote, authenticated attacker to use the 'stack show' comman CVE-2023-16267.8A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been declared as critical. This vulnerability affects unknown code in CVE-2023-16275.5A vulnerability was found in Jianming Antivirus 16.2.2022.418. It has been rated as problematic. This issue affects some unknown processing CVE-2023-16285.5A vulnerability classified as problematic has been found in Jianming Antivirus 16.2.2022.418. Affected is an unknown function in the library CVE-2023-16297.8A vulnerability classified as critical was found in JiangMin Antivirus 16.2.2022.418. Affected by this vulnerability is the function 0x22201 CVE-2023-16305.5A vulnerability, which was classified as problematic, has been found in JiangMin Antivirus 16.2.2022.418. Affected by this issue is the func CVE-2023-16315.5A vulnerability, which was classified as problematic, was found in JiangMin Antivirus 16.2.2022.418. This affects the function 0x222010 in t CVE-2023-16335.5A credentials leak flaw was found in OpenStack Barbican. This flaw allows a local authenticated attacker to read the configuration file, gai CVE-2023-16349.8A vulnerability was found in OTCMS 6.72. It has been classified as critical. Affected is the function UseCurl of the file /admin/info_deal.p CVE-2023-16356.1A vulnerability was found in OTCMS 6.72. It has been declared as problematic. Affected by this vulnerability is the function AutoRun of the