CVE-2023-3922

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible to hijack some links and buttons on the GitLab UI to a malicious page.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published
Sep 29, 2023
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-392218.8Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via netCVE-2023-392228.8OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary CVE-2023-392235.4Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerabiliCVE-2023-392248.0Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated atCVE-2023-392269.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary cCVE-2023-392277.5​Softneta MedDream PACS stores usernames and passwords in plaintext. The plaintext storage could be abused by attackers to leak legitimate uCVE-2023-392287.5Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via networkCVE-2023-392307.8Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user CVE-2023-392316.5PingFederate using the PingOne MFA adapter allows a new MFA device to be paired without requiring second factor authentication from an existCVE-2023-392336.5The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14. Processing web content may disclose sensitive informatCVE-2023-392347.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially crCVE-2023-392357.8Multiple out-of-bounds write vulnerabilities exist in the VZT vzt_rd_process_block autosort functionality of GTKWave 3.3.115. A specially cr
CVE-2023-3922: High severity, CVSS 7.1 | Vulnix