CVE-2023-2485

MediumCVSS 4.9/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.1 before 15.10.8, all versions starting from 15.11 before 15.11.7, all versions starting from 16.0 before 16.0.2. A malicious maintainer in a project can escalate other users to Owners in that project if they import members from another project that those other users are Owners of.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-266

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2023
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-248507.8Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application.CVE-2023-248517.8Memory Corruption in WLAN HOST while parsing QMI response message from firmware.CVE-2023-248527.8Memory Corruption in Core due to secure memory access by user while loading modem image.CVE-2023-248537.8Memory Corruption in HLOS while registering for key provisioning notify.CVE-2023-248547.8Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message.CVE-2023-248559.8Memory corruption in Modem while processing security related configuration before AS Security Exchange.CVE-2023-248567.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-248576.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-248587.5Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability CVE-2023-248597.5Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability CVE-2023-248607.5Microsoft Defender Denial of Service Vulnerability CVE-2023-248617.0Windows Graphics Component Elevation of Privilege Vulnerability