CVE-2023-4011

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions from 15.11 prior to 16.2.2 which allows an attacker to spike the resource consumption resulting in DoS.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Aug 2, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-401107.8In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escaCVE-2023-401117.8In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a cCVE-2023-401125.5In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclCVE-2023-401135.5In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. This could leadCVE-2023-401147.8In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. This could lead to local escalaCVE-2023-401157.8In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. This could lead to local escalation of priviCVE-2023-401167.8In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error iCVE-2023-401177.8In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to localCVE-2023-40127.5ntpd will crash if the server is not NTS-enabled (no certificate) and it receives an NTS-enabled client request (mode 3).CVE-2023-401207.8In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation. This couCVE-2023-401215.5In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization. This could lead to local iCVE-2023-401223.3In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to l
CVE-2023-4011: High severity, CVSS 7.5 | Vulnix