CVE-2023-4379

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions starting from 15.3 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Code owner approval was not removed from merge requests when the target branch was updated.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
GitLabGitLab>= 15.3, < 16.2.8; >= 16.3, < 16.3.5; >= 16.4, < 16.4.1

References

Timeline

Published
Nov 9, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-437905.4iTop is an IT service management platform. By manipulating HTTP queries, a user can inject malicious content in the fields used for the objCVE-2023-437918.8Label Studio is a multi-type data labeling and annotation tool with standardized output format. There is a vulnerability that can be chainedCVE-2023-437929.8baserCMS is a website development framework. In versions 4.6.0 through 4.7.6, there is a Code Injection vulnerability in the mail form of baCVE-2023-437937.5Misskey is an open source, decentralized social media platform. Prior to version 2023.9.0, by editing the URL, a user can bypass the authentCVE-2023-437944.9Nocodb is an open source Airtable alternative. Affected versions of nocodb contain a SQL injection vulnerability, that allows an authenticatCVE-2023-437959.8GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The OGC Web Processing ServCVE-2023-437965.3Synapse is an open-source Matrix homeserver Prior to versions 1.95.1 and 1.96.0rc1, cached device information of remote users can be queriedCVE-2023-437975.4BigBlueButton is an open-source virtual classroom. Prior to versions 2.6.11 and 2.7.0-beta.3, Guest Lobby was vulnerable to cross-site scripCVE-2023-437985.4BigBlueButton is an open-source virtual classroom. BigBlueButton prior to versions 2.6.12 and 2.7.0-rc.1 is vulnerable to Server-Side RequesCVE-2023-437997.8Altair is a GraphQL Client. Prior to version 5.2.5, the Altair GraphQL Client Desktop Application does not sanitize external URLs before pasCVE-2023-43806.3A logic flaw exists in Ansible Automation platform. Whenever a private project is created with incorrect credentials, they are logged in plaCVE-2023-438007.8Arduino Create Agent is a package to help manage Arduino development. The vulnerability affects the endpoint `/v2/pkgs/tools/installed`. A u
CVE-2023-4379: High severity, CVSS 7.5 | Vulnix