CVE-2023-3484

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 12.8 before 15.11.11, all versions starting from 16.0 before 16.0.7, all versions starting from 16.1 before 16.1.2. An attacker could change the name or path of a public top-level group in certain situations.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Jul 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-348406.1angular-ui-notification v0.1.0, v0.2.0, and v0.3.6 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2023-348429.8Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /de CVE-2023-348437.5Traggo Server 0.3.0 is vulnerable to directory traversal via a crafted GET request.CVE-2023-348449.8Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape.CVE-2023-348455.4Bludit v3.14.1 was discovered to contain an arbitrary file upload vulnerability in the component /admin/new-content. This vulnerability allo CVE-2023-348499.8An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1.CVE-2023-34853.6Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access t CVE-2023-348529.8PublicCMS <=V4.0.202302 is vulnerable to Insecure Permissions.CVE-2023-348537.8Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of Smc CVE-2023-348546.6HotelDruid before 3.0.6 has insufficient file upload sanitation in the backup/restore function.CVE-2023-348554.8A Cross Site Scripting (XSS) vulnerability in Youxun Electronic Equipment (Shanghai) Co., Ltd AC Centralized Management Platform v1.02.040 a CVE-2023-348565.4A Cross Site Scripting (XSS) vulnerability in D-Link DI-7500G-CI-19.05.29A allows attackers to execute arbitrary code via uploading a crafte