CVE-2023-3443

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 12.1 before 16.4.3, all versions starting from 16.5 before 16.5.3, all versions starting from 16.6 before 16.6.1. It was possible for a Guest user to add an emoji on confidential work items.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
GitLab	GitLab	>= 12.1, < 16.4.3; >= 16.5, < 16.5.3; >= 16.6, < 16.6.1

References

https://gitlab.com/gitlab-org/gitlab/-/issues/416497Broken Link, Vendor Advisory
https://hackerone.com/reports/2036500Permissions Required, Third Party Advisory
https://gitlab.com/gitlab-org/gitlab/-/issues/416497Broken Link, Vendor Advisory
https://hackerone.com/reports/2036500Permissions Required, Third Party Advisory

Timeline

Published: Dec 1, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-344307.8Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potenti CVE-2023-344316.7Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privil CVE-2023-344327.8A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a den CVE-2023-344339.8PiiGAB M-Bus stores passwords using a weak hash algorithm.CVE-2023-344347.5Deserialization of Untrusted Data Vulnerability in Apache Software Foundation Apache InLong.This issue affects Apache InLong: from 1.4.0 thr CVE-2023-344357.2A firmware update vulnerability exists in the boa formUpload functionality of Realtek rtl819x Jungle SDK v3.4.11. A specially crafted networ CVE-2023-344367.8An out-of-bounds write vulnerability exists in the LXT2 num_time_table_entries functionality of GTKWave 3.3.115. A specially crafted .lxt2 f CVE-2023-344377.5Baker Hughes – Bently Nevada 3500 System TDI Firmware version 5.05 contains a vulnerability in their password retrieval functionality whic CVE-2023-344387.8Race condition in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access CVE-2023-344395.4Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary scrip CVE-2023-34446.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.3 before 15.11.10, all versions starting from 16.0 befo CVE-2023-344407.5Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of priv