CVE-2023-2030

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 12.2 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which an attacker could potentially modify the metadata of signed commits.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-347

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 12.2, < 16.5.6; >= 16.6, < 16.6.4; >= 16.7, < 16.7.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/407252Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1929929Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/407252Issue Tracking, Vendor Advisory
https://hackerone.com/reports/1929929Permissions Required

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-20315.4The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up CVE-2023-20329.8The Custom 404 Pro WordPress plugin before 3.8.1 does not properly sanitize database inputs, leading to multiple SQL Injection vulnerabiliti CVE-2023-20338.8Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2023-20348.8Unrestricted Upload of File with Dangerous Type in GitHub repository froxlor/froxlor prior to 2.0.14.CVE-2023-20357.5A vulnerability has been found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this vulnerability is an unkno CVE-2023-20367.5A vulnerability was found in Campcodes Video Sharing Website 1.0 and classified as critical. Affected by this issue is some unknown function CVE-2023-20379.8A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been classified as critical. This affects an unknown part of the fi CVE-2023-20387.5A vulnerability was found in Campcodes Video Sharing Website 1.0. It has been declared as critical. This vulnerability affects unknown code CVE-2023-20398.8A vulnerability was found in novel-plus 3.6.2. It has been rated as critical. This issue affects some unknown processing of the file /author CVE-2023-20408.8A vulnerability classified as critical has been found in novel-plus 3.6.2. Affected is an unknown function of the file /news/list?limit=10&o CVE-2023-20418.8A vulnerability classified as critical was found in novel-plus 3.6.2. Affected by this vulnerability is an unknown functionality of the file CVE-2023-20428.8A vulnerability, which was classified as problematic, has been found in DataGear up to 4.7.0/5.1.0. Affected by this issue is some unknown f