PT-2018-5143 · Gitlab · Gitlab Ce/Ee+1

Publicado 2018-03-18 · Atualizado 2019-10-09 · CVE-2017-0916

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3

Description The issue is related to a lack of input validation in the system hook push queue through the web hook component, resulting in remote code execution.

Recommendations For Gitlab Community Edition version 10.3, consider disabling the web hook component until a patch is available to prevent remote code execution. Restrict access to the system hook push queue to minimize the risk of exploitation.

Correção

RCE

Command Injection

Enumeração de Fraquezas

CWE-20

CWE-77

Identificadores relacionados

CVE-2017-0916

DSA-4145-1

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 19

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0926 · Nota de Segurança
• https://gitlab.com/gitlab-org/gitlab-ce/issues/32198 · Nota
• https://security-tracker.debian.org/tracker/source-package/gitlab · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0915 · Nota de Segurança
• https://hackerone.com/reports/299473 · Nota
• https://osv.dev/vulnerability/CVE-2017-0916 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-4145-1 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-0916 · Nota de Segurança
• https://osv.dev/vulnerability/DSA-4145-1 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Nota
• https://debian.org/security/2018/dsa-4145 · Aviso do Fabricante
• https://about.gitlab.com/releases/2018/01/16/gitlab-10-dot-3-dot-4-released · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Nota de Segurança
• https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released · Aviso do Fabricante