PT-2018-5153 · Gitlab · Gitlab Ce/Ee+1

Publicado 2018-03-18 · Atualizado 2019-10-09 · CVE-2017-0926

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gitlab Community Edition version 10.3

Description The issue is related to an improper authorization problem in the Oauth sign-in component, which can result in unauthorized user login. This allows unauthorized access to the system.

Recommendations For Gitlab Community Edition version 10.3, consider disabling the Oauth sign-in component until a patch is available to prevent unauthorized user login. Restrict access to sensitive areas of the system to minimize the risk of exploitation.

Exploit

Correção

Improper Authorization

Incorrect Authorization

Enumeração de Fraquezas

CWE-285

CWE-863

Identificadores relacionados

CVE-2017-0926

DSA-4145-1

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 18

• 🔥 https://gitlab.com/gitlab-org/gitlab-ce/issues/32198 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0918 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0926 · Nota de Segurança
• https://security-tracker.debian.org/tracker/source-package/gitlab · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0915 · Nota de Segurança
• https://security-tracker.debian.org/tracker/DSA-4145-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4145-1 · Aviso do Fabricante
• https://debian.org/security/2018/dsa-4145 · Aviso do Fabricante
• https://about.gitlab.com/releases/2018/01/16/gitlab-10-dot-3-dot-4-released · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0916 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-0926 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0926 · Aviso do Fabricante
• https://about.gitlab.com/2018/01/16/gitlab-10-dot-3-dot-4-released · Aviso do Fabricante
• https://packages.debian.org/src:gitlab · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0925 · Nota de Segurança