PT-2018-4301 · Gitlab · Gitlab

Publicado 2018-01-05 · Atualizado 2018-01-18 · CVE-2014-8540

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GitLab versions 6.x through 7.x before 7.4.3

Description The issue concerns improper permission checks in the groups API, allowing remote authenticated guest users to modify ownership of arbitrary groups.

Recommendations For GitLab versions 6.x through 7.x before 7.4.3, update to version 7.4.3 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2014-8540

Produtos afetados

Gitlab

Referências · 8

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8540 · Nota
• https://about.gitlab.com/releases/2014/10/30/gitlab-7-4-3-released · Nota
• http://securityfocus.com/bid/70841 · Nota
• http://openwall.com/lists/oss-security/2014/10/31/2 · Nota
• https://gitlab.com/gitlab-org/gitlab-ce/commit/a2dfff418bf2532ebb5aee88414107929b17eefd · Correção
• https://about.gitlab.com/2014/10/30/gitlab-7-4-3-released · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98449 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-8540 · Nota de Segurança