CVE-2023-4532

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab affecting all versions starting from 16.2 before 16.2.8, all versions starting from 16.3 before 16.3.5, all versions starting from 16.4 before 16.4.1. Users were capable of linking CI/CD jobs of private projects which they are not a member of.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-863

Affected software

VendorProductVersions
GitLabGitLab>= 16.2, < 16.2.8; >= 16.3, < 16.3.5; >= 16.4, < 16.4.1
gitlabgitlab>= 16.2, < 16.2.8
gitlabgitlab>= 16.4, < 16.4.1
gitlabgitlab>= 16.3, < 16.3.5

References

Timeline

Published
Sep 29, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-453207.8Uncontrolled search path element in some Intel(R) VTune(TM) Profiler software before version 2024.0 may allow an authenticated user to potenCVE-2023-453218.8The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocolCVE-2023-453226.5libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails. This occurs in xmlUnlinkNode in treCVE-2023-453239.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'name' parameter of the routerCVE-2023-453259.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'address' parameter of the rouCVE-2023-453349.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'status' parameter of the routCVE-2023-453369.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'password' parameter of the roCVE-2023-453389.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'id' parameter of the routers/CVE-2023-45346.1A vulnerability, which was classified as problematic, was found in NeoMind Fusion Platform up to 20230731. Affected is an unknown function oCVE-2023-453409.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the routeCVE-2023-453419.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The '*_price' parameter of the rouCVE-2023-453429.8Online Food Ordering System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'phone' parameter of the route
CVE-2023-4532: Medium severity, CVSS 4.3 | Vulnix