CVE-2023-3914

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A business logic error in GitLab EE affecting all versions prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1 allows access to internal projects. A service account is not deleted when a namespace is deleted, allowing access to internal projects.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-286

Affected software

VendorProductVersions
GitLabGitLab< 16.2.8; >= 16.3, < 16.3.5; >= 16.4, < 16.4.1
gitlabgitlab< 16.2.8
gitlabgitlab>= 16.3.0, < 16.3.5
gitlabgitlab>= 16.4.0, < 16.4.1

References

Timeline

Published
Sep 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-391417.5webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability.CVE-2023-391439.8PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. ThCVE-2023-391447.5Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.CVE-2023-391477.8An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.CVE-2023-39157.2An issue has been discovered in GitLab EE affecting all versions starting from 16.1 before 16.1.5, all versions starting from 16.2 before 16CVE-2023-391509.8ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code executCVE-2023-391515.4Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperCVE-2023-391526.5Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asCVE-2023-391535.4A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick usersCVE-2023-391546.5Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/ConfigurCVE-2023-391555.3Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe CVE-2023-391565.3A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Ba
CVE-2023-3914: Medium severity, CVSS 5.3 | Vulnix