CVE-2023-6678

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An issue has been discovered in GitLab EE affecting all versions before 16.8.6, all versions starting from 16.9 before 16.9.4, all versions starting from 16.10 before 16.10.2. It was possible for an attacker to cause a denial of service using malicious crafted content in a junit test report file.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1333

Affected software

Vendor	Product	Versions
GitLab	GitLab	< 16.8.6; >= 16.9, < 16.9.4; >= 16.10, < 16.10.2

References

https://gitlab.com/gitlab-org/gitlab/-/issues/434689Broken Link
https://hackerone.com/reports/2268037Permissions Required
https://gitlab.com/gitlab-org/gitlab/-/issues/434689Broken Link
https://hackerone.com/reports/2268037Permissions Required

Timeline

Published: Apr 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-66795.5A null pointer dereference vulnerability was found in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c in the Digital Phase Locked L CVE-2023-66808.1An improper certificate validation issue in Smartcard authentication in GitLab EE affecting all versions from 11.6 prior to 16.4.4, 16.5 pri CVE-2023-66815.3A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-fo CVE-2023-66826.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.9.7, starting from 16.10 prior to 16.10.5 CVE-2023-66836.5A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. The qemu_clipboard_request() function can be reach CVE-2023-66845.4The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ive' shortcode in versions CVE-2023-66876.5An issue was discovered by Elastic whereby Elastic Agent would log a raw event in its own logs at the WARN or ERROR level if ingesting that CVE-2023-66886.5An issue has been discovered in GitLab CE/EE affecting all versions starting from 16.11 prior to 16.11.2. A problem with the processing logi CVE-2023-66898.8A successful CSRF attack could force the user to perform state changing requests on the application. If the victim is an administrative acco CVE-2023-66902.0A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on transferred repositories by making a Graph CVE-2023-66917.8Cambium ePMP Force 300-25 version 4.7.0.1 is vulnerable to a code injection vulnerability that could allow an attacker to perform remote cod CVE-2023-66926.4The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's tab anchor