PT-2018-14688 · Gitlab · Gitlab Ce/Ee+1

Mayra Cabrera · Publicado 2018-12-04 · Atualizado 2019-02-05 · CVE-2018-18843

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 11.0.0 through 11.2.7 GitLab Enterprise Edition versions 11.3.0 through 11.3.8 GitLab Enterprise Edition versions 11.4.0 through 11.4.3

Description The issue affects the Kubernetes integration in GitLab Enterprise Edition, allowing for Server-Side Request Forgery (SSRF).

Recommendations For GitLab Enterprise Edition versions 11.0.0 through 11.2.7, update to version 11.2.8 or later. For GitLab Enterprise Edition versions 11.3.0 through 11.3.8, update to version 11.3.9 or later. For GitLab Enterprise Edition versions 11.4.0 through 11.4.3, update to version 11.4.4 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2018-18843

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 6

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/53158 · Exploit
• https://about.gitlab.com/releases/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released · Nota
• https://about.gitlab.com/2018/11/01/critical-security-release-gitlab-11-dot-4-dot-4-released · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18843 · Nota
• https://osv.dev/vulnerability/CVE-2018-18843 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-18843 · Nota de Segurança