CVE-2023-3979

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 10.6 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. It was possible that upstream members to collaborate with you on your branch get permission to write to the merge request’s source branch.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 29, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-397969.8SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via CVE-2023-39804.8Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.CVE-2023-398014.6A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Se CVE-2023-398046.2In GNU tar before 1.35, mishandled extension attributes in a PAX archive can lead to an application crash in xheader.c.CVE-2023-398059.8iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.CVE-2023-398069.8iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.CVE-2023-398079.8N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a SQL injection vulnerability via the a_passwd parameter at /portal/user-reg CVE-2023-398089.8N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain a hardcoded root password that allows attackers to login with root privilege CVE-2023-398099.8N.V.K.INTER CO., LTD. (NVK) iBSG v3.5 was discovered to contain an OS command injection vulnerability via shell metacharacters in the system CVE-2023-39814.9Server-Side Request Forgery (SSRF) in GitHub repository omeka/omeka-s prior to 4.0.2.CVE-2023-398107.8An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.CVE-2023-39824.8Cross-site Scripting (XSS) - Stored in GitHub repository omeka/omeka-s prior to 4.0.2.