PT-2017-10683 · Gitlab · Gitlab

Publicado 2017-03-28 · Atualizado 2019-10-09 · CVE-2017-0882

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions GitLab versions prior to 8.15.8 GitLab versions prior to 8.16.7 GitLab versions prior to 8.17.4

Description Multiple versions of GitLab expose sensitive user credentials when assigning a user to an issue or merge request.

Recommendations For versions prior to 8.15.8, update to version 8.15.8 or later. For versions prior to 8.16.7, update to version 8.16.7 or later. For versions prior to 8.17.4, update to version 8.17.4 or later.

Exploit

Correção

IDOR

Information Disclosure

Enumeração de Fraquezas

CWE-639

CWE-200

Identificadores relacionados

CVE-2017-0882

Produtos afetados

Gitlab

Referências · 10

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/29661 · Exploit
• https://gitlab.com/gitlab-org/gitlab-ce/commit/cdf396f456472ef8decd9598daa8dc0097cd30c5 · Aviso do Fabricante
• https://gitlab.com/gitlab-org/gitlab-ce/commit/a70346fc6530aa28a98e4aa4cf0f40e2c3bcef6b · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0882 · Nota de Segurança
• https://about.gitlab.com/releases/2017/03/20/gitlab-8-dot-17-dot-4-security-release · Nota
• https://gitlab.com/gitlab-org/gitlab-ce/commit/43f5a2739dbf8f5c4c16a79f98e2630888f6b5d1 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0882 · Nota
• http://securityfocus.com/bid/97157 · Nota
• https://about.gitlab.com/2017/03/20/gitlab-8-dot-17-dot-4-security-release · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0882 · Aviso do Fabricante