PT-2023-2596 · Gitlab · Gitlab Ce/Ee+1

Jobert · Publicado 2023-04-15 · Atualizado 2023-04-25 · CVE-2018-17455

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions GitLab Enterprise Edition versions 11.1.7 and earlier, 11.2.x before 11.2.4, 11.3.x before 11.3.1

Description An issue was discovered related to the "merge request approvals" feature, where attackers could obtain sensitive information about group names, avatars, LDAP settings, and descriptions via an insecure direct object reference. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For versions 11.1.7 and earlier, update to version 11.1.7 or later. For versions 11.2.x before 11.2.4, update to version 11.2.4 or later. For versions 11.3.x before 11.3.1, update to version 11.3.1 or later. As a temporary workaround, consider restricting access to the "merge request approvals" feature until a patch is available.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

CWE-99

Identificadores relacionados

BDU:2023-02425

CVE-2018-17455

Produtos afetados

Gitlab

Gitlab Ce/Ee

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2018-17455 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17455 · Aviso do Fabricante
• https://about.gitlab.com/releases/2018/10/01/security-release-gitlab-11-dot-3-dot-1-released · Aviso do Fabricante
• https://about.gitlab.com/blog/categories/releases · Nota
• https://vuldb.com/ru/?id.226129 · Nota
• https://t.me/cvenotify/48350 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17455 · Nota
• https://bdu.fstec.ru/vul/2023-02425 · Nota de Segurança