CVE-2023-2022

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2, which leads to developers being able to create pipeline schedules on protected branches even if they don't have access to merge

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-262

Affected software

VendorProductVersions
GitLabGitLab< 16.0.8; >= 16.1.0, < 16.1.3; >= 16.2.0, < 16.2.2

References

Timeline

Published
Aug 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-202208.8Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCVE-2023-202216.5A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow CVE-2023-202226.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coCVE-2023-202238.2A vulnerability in Cisco DNA Center could allow an unauthenticated, remote attacker to read and modify data in a repository that belongs to CVE-2023-202247.8A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local CVE-2023-202267.5A vulnerability in Application Quality of Experience (AppQoE) and Unified Threat Defense (UTD) on Cisco IOS XE Software could allow an unautCVE-2023-202277.5A vulnerability in the Layer 2 Tunneling Protocol (L2TP) feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker toCVE-2023-202286.1A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteCVE-2023-202297.1A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attackeCVE-2023-20236.1The Custom 404 Pro WordPress plugin before 3.7.3 does not escape some URLs before outputting them in attributes, leading to Reflected Cross-CVE-2023-202305.4A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow anCVE-2023-202318.8A vulnerability in the web UI of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against
CVE-2023-2022: Medium severity, CVSS 4.3 | Vulnix