CVE-2023-5512

MediumCVSS 5.7/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab CE/EE affecting all versions from 16.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. File integrity may be compromised when specific HTML encoding is used for file names leading for incorrect representation in the UI.

Metrics

CVSS 3.1 5.7/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Dec 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-55145.3The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumerCVE-2023-55155.3The responses for web queries with certain parameters disclose internal path of resources. This information can be used to learn internal stCVE-2023-55165.3Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing informationCVE-2023-55177.5A flaw in query-handling code can cause `named` to exit prematurely with an assertion failure when: - `nxdomain-redirect <domain>;` is coCVE-2023-55194.3The EventPrime WordPress plugin before 3.2.0 does not have CSRF checks when creating bookings, which could allow attackers to make logged inCVE-2023-55207.7Out-of-bounds Read in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-55219.8Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.CVE-2023-55224.3Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emojCVE-2023-55237.8Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS CVE-2023-55247.3Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows CVE-2023-55254.3The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowingCVE-2023-55278.0The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-
CVE-2023-5512: Medium severity, CVSS 5.7 | Vulnix