PT-2023-10696 · Gitlab · Gitlab Ce/Ee+1

Ngalog · Publicado 2023-04-15 · Atualizado 2023-04-25 · CVE-2018-17449

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Community and Enterprise Edition versions 11.1.0 through 11.1.7 GitLab Community and Enterprise Edition versions 11.2.x through 11.2.4 GitLab Community and Enterprise Edition versions 11.3.x through 11.3.1

Description An issue allows remote attackers to obtain sensitive information about issues, comments, and project titles via the events API insecure direct object reference.

Recommendations For versions 11.1.0 through 11.1.7, update to version 11.1.7 or later. For versions 11.2.x through 11.2.4, update to version 11.2.4 or later. For versions 11.3.x through 11.3.1, update to version 11.3.1 or later.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2018-17449

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 6

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17449 · Nota
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17449 · Nota de Segurança
• https://t.me/cvenotify/49072 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-17449 · Aviso do Fabricante
• https://about.gitlab.com/blog/categories/releases · Nota